Extracting prog: 55m7.377356527s Minimizing prog: 31m9.502084055s Simplifying prog options: 0s Extracting C: 34.995524162s Simplifying C: 26m27.408732485s extracting reproducer from 68 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-ioctl$FE_GET_EVENT-ioctl$FE_SET_FRONTEND detailed listing: executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash single: failed to extract reproducer bisect: bisecting 68 programs with base timeout 30s testing program (duration=47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 32: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c2e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x1) ioctl$FS_IOC_READ_VERITY_METADATA(r1, 0x2201, &(0x7f00000000c0)={0x2, 0x6, 0x0, 0x0}) executing program 33: r0 = fsopen(&(0x7f0000000040)='binfmt_misc\x00', 0x1) r1 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x3) executing program 34: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x2, 0x0, 0x2b}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x802d, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e20, 0x4e20, 0x1d, 0x0, @gue={{0x1, 0x0, 0x0, 0xff, 0x100, @void}, "b68ed34f131c03e57e518e4d0800000040"}}}}, 0xfdef) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r1, 0x4004480d, &(0x7f0000000080)={0x5, "1f7f67491b5a90eeaddb94a4031a82687063ba6e44f7b91d902d0008424ad04b9634bef178be4ba64223a1d6da6d232b4ea6a453724e5a9c45a204ec36715596"}) executing program 5: r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000340)) close_range(r0, 0xffffffffffffffff, 0x0) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x3ff8, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876) executing program 5: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x44000, 0x0) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) close(0x4) executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x80000000, 0x4) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x40, 0x3a, 0x0, @private0, @mcast2, {[], @dest_unreach={0x1, 0x1, 0x0, 0x0, '\x00', {0xd, 0x6, "310300", 0xf4e, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @private0={0xfc, 0x0, '\x00', 0x1}, [@fragment={0x3a, 0x0, 0xc, 0x0, 0x0, 0x1, 0x68}], '\r\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x1000}], 0x1, 0x40012040, 0x0) executing program 35: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x80000000, 0x4) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x40, 0x3a, 0x0, @private0, @mcast2, {[], @dest_unreach={0x1, 0x1, 0x0, 0x0, '\x00', {0xd, 0x6, "310300", 0xf4e, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @private0={0xfc, 0x0, '\x00', 0x1}, [@fragment={0x3a, 0x0, 0xc, 0x0, 0x0, 0x1, 0x68}], '\r\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x1000}], 0x1, 0x40012040, 0x0) executing program 7: r0 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain={'key_or_keyring:', r2}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain={'key_or_keyring:', r0}) executing program 7: setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x0, 0x0, 0x1, 0x0, 0x100}, 0x1c) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) executing program 7: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x1c, 0x2, 0xeffe, 0x9, "8d510291002a49500d000080009b1dffff6a1d73f2000000fffffffc00fbf29c"}) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x1c, 0x2, 0xeffe, 0x9, "cd511591002a49500000008000000000f86a1d73f20000000000000000fbf29c"}) executing program 8: r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="add124a0c9a43b2292136226b5ba7ada5317f080e8b9"], 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@getsa={0x28, 0x12, 0x20, 0x70bd26, 0x25dfdbfb, {@in=@local, 0x4d2, 0x2, 0x3c}}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) executing program 7: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89001) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xc) executing program 7: openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x121a02) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xb38a, 0x80, 0x8002, 0x272}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x101, 0x11, 0x5, 0x0, 0x0) executing program 8: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'macsec0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r1, {0x5, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040054) executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x6, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "715150b1971bbe75", "8c419c4cb217d59a5e2108c76ca18dad", "8869fdbb", "ddc7586e28e54682"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) executing program 36: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x6, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "715150b1971bbe75", "8c419c4cb217d59a5e2108c76ca18dad", "8869fdbb", "ddc7586e28e54682"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) executing program 8: r0 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000001c0)) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000d1a000/0x2000)=nil, 0x1, 0x0, 0x0, 0x237, 0x0, 0x2, 0x0, 0x2}) executing program 8: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89001) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xc) executing program 8: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r0, 0x0, 0x0, 0x80800) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x1) executing program 8: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 1: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 39: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 2: r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x1) r1 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r1, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r2) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='lp', 0x2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) executing program 0: renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0x76, 0x101341) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0x12d) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0x80045515, &(0x7f0000000100)=@usbdevfs_driver={0x80000001, 0x6, 0x0}) executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x200, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x4, 0x8, 0x409, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) pread64(r0, &(0x7f0000000700)=""/115, 0x73, 0x5) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x8}) close(r0) executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206030000000000000000000000000011000300686173683a6e65742c6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007800800084000000078050014"], 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0x122, @tick=0x7, 0x0, {}, 0xfc, 0x0, 0x8}) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x0, 0xd13a5dbb099f029b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: io_submit(0x0, 0x0, &(0x7f0000000140)) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040ba124b0700000000000109022400010000102c09040005010300010009210080090122180009058103"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 9: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000340)="1735", 0x2, 0x240148c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x10022, 0x0) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x5, 0x8, 0xffffffff, 0x7}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000006000)=@vmx={0x0, 0x0, 0x2080, {0x54000, 0x8080000, {}, 0x1, 0x6}, {"cfe274ab958596a18f48df8c02940a5f500fb5b3c7c98a8f1bab36eedb7479373c8e69e784da80d6f072c0e004dc9b1e1e55341fbc56e170067b1cc38d2b253298bd202f2e123d5648d7c52fe8d4ae4f2658e7fade39ca34735a5dda720272b7dd244c887ef38ab2e1f76903c3e17a5b9a4a39b439833517e44fdafb5ec17fcee283ce983ad4332b583a1261cc30690a4f91f8676865ed446d6fdef42a9e0407d0dbe32716b6743e01bc02527c0e0afa7ad94f4cf53f4b9d4be36ca2d48f8ceafedd9f65898c3811c23eb05666241ebd78b7a476b5a6aebf38780257e5d150c1c88433569aff06305d5306161adf35899e4bd72b1c84c602b16eff131f30a06c20da4747ce17482d42fc241a3133d01463215de68c845f90a6998e9129f22f4140a47d225585ac94000f1cc8a55f3b381cdd71bd57652f063be52b4dd6679fb43d3a6fbf74abdf79ab07a8e289dee138c9c504bf787b188217111f81679394236aa10b47003834f9b5e05486f11d3ad525119c7d6c6290181c351b857f4cfa302d6ef2ee89f5a68201014de2e1dbddc1b67b67e17a9a6d4531092120470686449a2cab9a737c5e04accb6067d046f7ecbd1b745b58dd15879c1ea48faf012fc03501d167637c7b78d47299ae76537996f36a272766c3f2ff2cd7dfa6e0d813c41cc633478d74ee5dced5ee788f11b7d75926d22eefe7a8b6be5d55ef759769f595a6390cca7702871c34d889eafd379fd6df37677c0f5e060ed8890b4e8079e598c71c687130795d66fc3c50bded002e3cd07fed23fe008809646f0b0b349a0420eee2077dedca495cf22a9376811032388c7e9a218200881a2408a2dc3644b11b3e709a450e1da7caf79d221671f2e4332054d3118bc84fa4ebcf30fa6a5477638ef92158ec38808bdc1520621b6b1885618eaf456b65adfd1ec5db0d070e767ed7aa95f3b7f1b61cf63909f5f556ac9c82278ad43db0d15f09a6d36942fdd4100aa3f34ee28ff77e05216770295dca0a6eb60aeb98935fc7af6df76ff5215c19c10361fb99ee4b3a3f38acd749e26256152d9cad7ab95bccadca1916941987b23c4ee9e56325a973c0afd1fd7f92e3cfe5f32f4b16144e6b88d6ad1977e7367d7545c0f3b4202045bf2eef2f6c3df29d3d3ed10e20f0b2d5695421220eafc9b270261aec292f5edc0f7a8aea41be384ff81aff8c44f07cb75b0549c316ed300c80d34cb269b043843f3e39d5ad4aa8d27825fd1ea49fc4415889c71446b33389b042aa59be1fc85ec0b4748f36a37054d54c518787f37366b629ec8802d0a853f520025a25e410b4a5014fb9ee3fd83b839722110c3909c73c78a09d8919c04da7ca27c2083766b2b38f97f0a41822e6ad881055defbac2c9a8aa1b46b598a39fd5d40ff921b956115914fd34db7d8d781a27dfc69df20555b5f80b25d8d7d8e01afa1180b7f65272d149a5f0d80d6a22798a6c6fbeac2c817505fd32d40c7e5a04c56abc78fe9c004364c00920edba0a59dab84e6b44df825660fc843315ab9d184cb46fc7dbf87c4e1e332d9e608f0849e160195e0edbc31ffef22543754df8905e5768fcb0cb190e5f047fab6c41044e74f5b1070bf1b0d4a8cb94f92e270eee0962e980206c07da947b41474f004089e65a95946282cceccc0a92a3ac45f37dcc93f51d04f669049a06d98340834d19042855aadff35bd47de85fea05a17ab1edc312eb40400645e8e12906e4de1a27adcb28a57db5281e48a02441b7cb1dfcee0fd8d5f868942baedbc1f83dfebc8ada3ab643f18b326f09f56e2c336af81169634ed1ffc178f655475090a2a00b68b83dec9ddde6ecd017edddde191e1461ae78856f369c7ea7fc08830f84a369cab38ef3f2657992efca64222ee289ca30698457232ee8c30d13d58aaa5876fe66d3146ff584a6c51ddf8784c6099453e6e847a263e54ae6c03fd6fb4380639d2b850fb8bde3794883dfe672e30343a5505db047c31b57e4afd79f9f7423020aec0efb61e4ad76f149fcb5564de26602b228b8fd9b82238a658b70268628abd7936690e2fce88ab6bda0cb75bc94188081d42ac369d313e73f71d8bd0a773d23ca93d81d1f2f65d8a2b72d5c5c4f8fe244dd49ad253b69c07f673c0a6b56f51fd315568f001c63cb22f43ef8cc8d6d50ccb07c89075f4beb575aa8e95bbfeb946a428a36ef6e7388f2f03de8fc958d2cade4e8c16308f92fe65f122f580c83e69566fc683022003528b332be2bb324894dcabca0ad4886c2b7dcff3f9fac5a93e2103012493874aecb1849be62834891f87863cc6647f7881ec3d05f82203c1dee4347f65e8076cfecbd62baf7b1da7862964178b759f3bcbd53e91750ad1d9d70189c1b8c929dae459c5bc2a51fb01a47a06ec34ded19c50f8d2a53c6dceabff41242070c7745437967b0b39bc4213c25eadf9da3c8019905b21076d20d985705778521cf5b93f8800b06d1db31761b3d2d7d583d7b37407d1e08749b5c8009c8af72de1fb7f8468c79f9efb6b15a72ec770a73940675786539ddc2395fda8654e5062758faab10693fba92eefd2aad723d6565773f74c961e42934dddabfb4da790d9e4f18310768867363d7231a80c4953fd250a8b62be3f4853afc2a7faf537870f0a2388af5ccad3b2b62faa47c0d555f02120aa16af41278da51128ea14a2665019a5d34c79ffca9ae789034adbc56c8a73ceb0f1ebbf540723fab2ba52bf18a33ee20ecd38721860809da674e07046fcf3a7565aac21b27062b2c1e26ed6c006447e4b237948701e05d6b30d1983bc4b5fc575e05734052f4440f615cc135a38d811d008578fc35037a25b2f8b4b5bf483d174043d02faa8af4ed3c522a289f61f5b46c713d22645657015f323281ad0e6043326dd1fc9070185288edd97d5a076c2ecd331930af8a5651d05c5a7fa8700a7ce1ea8241ecc50a1c20f5315a4a7494ed0817808f3075745dbcf492142632c9a8d8a06ea490eecadc32fd962b244feec473e92012fd51b8697b3c5fdff1785fee23e240658696db5e9f1ece878c4e609593946b320b657fee3f3c8632e7c80a937d2b16a22c01bafc86da04b8bf08d93d2027d1feb37c355434696fd892378c74e3a4b0866125b4647e595e3716b8f7bf1430b31bc9999963be069f513876bc3f6cc10b74e6941089791f14e032133663174ab2e5fb4ab61e77c3e302ae5ad774d9cde9520395a087b3230150c14beadac595e03bf24faaa4f783f298ebdd4f1f797c0e57763b2341c143547488b975a586abc582b03c44398ebed8a91b0dcf6db7c2e529a78197feb8d5c3efa167cb9e7561f59913c7f670375e22bea287efcc2d752588f3dbd20467859404f235eab1ff551a68844790154f1f64a09eb846643cd912fdd536a182efd02165f75a730b0e8d120af8759405fc114c23ed038de55ef5888466d9403fa309b593c126e04baae5b19a160324c58d5b7f448b1fa19f69042c5729af96a4f397d1e0d94470176ab051fba1d42058d07baebd3938c3a91a18432be62aac2805083d0452d2c3f0f70ccda5236f2455273565ed876f0e4581c34003683af5d1b3a3c57d369c7bc44850ef6f5a0d7007d5ca2771200bb1407587b117321d7bb8cbe4e0030d23c1f1571e030037d3a65413598f192a7500d3bb09fc1886f43ba5864fe47c369c1adff320bf2a2d11a74af76d8b8327de8f0be24591901408a532c26186b210a83c4c4d6aa799ef5add3146aa07310352791d1fc151bad89c9a28f3289ccea80ad713974609c2883b8871ef4a5fd9d5f1d754e580cf0ecff281b4fb3d6b969881e085fcdf84b909eb370d24351ddbd68adfb8ec199a4278d0ef57c31376939469d41578891729a8e20911e15367c369392293f9bb25d8828d22bf679ef33b0ba9ce574d854a4e916618db649b3b24dc6d66311c1daef9a6de6bbb2f3bee14f6509c2e7d53c1f37fad8f2a4b238c57a4c3015f68f8d750850e61ee6133f14e2a17bac58138938aa0cb8139cf6b361879b9633ec25282e9a4586d1f633839b13c60e8181e7dfff7634d12b379795292c71e00f49ddc82c2bfdda96a7df8be5cdf12b95491c28183efcebdacc6c4fa729f5fb7b5c84bb22dd502ac9e749b1e9fea78f7ffc8e55411f72cd628d7dbd1a7cc67689ed68c7fa144103a3157b329f13191904cc6db29e2d6c672c9132dec1e1e784e0e0b22688884dbff9e82c83a1001b13ccf1e06722e9a18f62e6727b4154beade00fe9b76fc504a74f8e212b96f2ddc3421211bb61e5e16931ed0b3c2e03e898f1d4cc619b127e195bbe51a3efc4bbca90126cda7c4fccba3e9069e80692497fff522a9aaeb93064282b21d0455ac14da7c0fbae48924a567425a0fe13a76edc0d4edc46489a54cf39631fc7f98eb3daa6a3b8ff7b648d8ad9444d915c1204ab669eb6e715822592ed6673ee6992f32d259458d4becc02fd57f249569de6880632edc42d9b3a15b877981a6d807a661511ec3cb5bfa017b66cff803b44914fb4cb309c4fdeb1632c26c78bc480843e7376bcf95a6acc2fb6b21aee33641dfc0ad8292586b4deb7c09452a99effcb65ac49b68b2bc47d3620d36389a094d628ade5c907fb15abb3441f95703f66c1022fe6556f85dff37e8cc543341ec8f50f53129b1f01a8610efcb9e5c4c5a5b721f1f8bfcc17f139c5eeec9f102e605872b75851ab1102095dc23670c7d2224d308bd688e49c353ddac2833e619e06d9edeb8d427259377164764dee15d3afce445350e6a281305ffce2858217d214bf6517ec677ea79ae84a483ccd022fe0c21bc7923bdad51e0f5b17369f9e3969b5c30924b522cddc0fb221e36a325e383f62355e4677fcd8a8f228546e4c7cf41b109a0136156a4f0426e9ad9f821c4f0b9fd036b20f9bc612838e63bd5db4f1f2654dbc5484268567a7c55d91a5d40156489154f5513ec5b0ca928c00a251c7f5c7e008cd72ae0815a8ff081d15729f3b66a8aa731f491b877916d19c528bbc2c388b1d4f1d6a9a21f621a24075d332e20febc385a68d3c01d2aae555a03ff8bfd61823b12f7b6c3fa939b9cdfaa498c0a9a9ec0927e0fa119ac03f54613ae42a51a569f790e49c30fe9efdd43e18da9663592a44d7986735281c473d94ae7858a1d6260797d08af52a5942faf767a389d8a6b509c12a411b19bcd6898f4f7484435770e4932b036aca20636b5f2765264684694606a71b70843b8cc0972d772c8c7435450ba8f6b63eba3690cfdc8f002dfa31df2e54b6066fed99241eeca470f4d7acc647e51f8ae2152842f28864ffb8a7e843ba895c7a7f1922ed79da68412ba76e22cb2e0bd8cd4483314f20cb14fe89595a03eef031d846c3fdfa7eb49fdd5d60d30ffa9fae4817a98737c9d7a83c9074daf02eece73d4506019ce6d65d8d3889c3510c3985b85ed6a9d3d660cb2260b9b78758295109b135ce79ade8b75619e952ca2a0fe1670a461f47dfc6aa6d85c332ed9f37afcb1d9fa6364c15947b281ecffbf8895ff4f5343877599c64f7b105865f0988e347d56a45045529d9f99f79d756f2b618a3fe580bc66a11f8c2a5f577bd801690ac3d7a9bdcc49db3155c5819144afa6c5626bdbc1f9410fcaea346490570c0e21ebc62d1791a24cbcd302912a14a1b494249c2b7347904db109310157c0aee443f04e20451a5a9486aeb0521831dbfbac1f716fb956c03bdaf7723623edbc80c0fe2afd236760978b381a5a865a3bf27e3e7e28a107d0d185d3b00", "74485c02cc3d2feede8f343ae164753039c041dc8e83cbb16678625e308951b919ec42532b0ddebf7bd568e938d258f3ee00d3c529fa5056f3c4ba54a8a4a57e03b62d308475e0403e0169eae259f614fdb3572e19dacebbff87a37f3fadc45c37fa5c0ada4ad4777018737d1a633402cb48311c00a365ea9d15d383e5a9a1b8510350d8e353ba46ab94629d2c9d865b5ab0142faa11b9b3b75a010c3fa12fb17b7f22889d64516b98ecb1d3d5abdd1a9065ea3c61b75a381ca3fc72833aeb3ce266350618d35206a9fd47328077a3407f75b965a36f422cb7ccf0cdd3320bc89f8d43f54db8ad280d988f31e4bd2e0b349207c746737eaec5763673e460d3fc1ca92e147c0c0076b5ee01ef09015936e5ff2a722b0f30b853de48db22251fff8db43f5aff7cfda61aa8a30acc52547fc4f1ba86d65c5cff8a8fd4f14292d647e41fd91a8926f5ce0a92a217b47cb4a01eb1fe44da0badaa18e63df95ebd492401e4f19c351a77b4915d14dc0903ffd196bdb3bae0841dabd83c3bd336d2eb8d2b1d52e351cf1d13d2556bec6c3773cbc8326a5b1e029a9a0d5501e8615e8a2693097c32cf504806c94bd6292a0e9c273bdb7418bcd6dcab07fde463d85b0ae7a273adbfa7a6bcaf62f59d9ceb5b90ddf2fa09335e2499bc18a1c0ec28f83424571022f6e03e4b06c96ae14d25ed4655c30be46ab30ad742380a4733782ec29fcb17b0c42a18ec98d39143679cf6021e1866eb78d734417a7a90fe94ff1f7d63252a3f2f552f61d5629c4834e144a83dbf47753770fa1169a9d7581b2d2f913048d1019c35a993d20803435696eaf879060c03c1fc133773db22f0dd29064129e87bb4cb810afa8b3a4c211f5ed4ee82e542c1802001ccdd2cf4bb44655bbc18bdd810dec8bf439880402573a58ec5d98dffe37bdda12610d78ca9149111b67682f563efd0ff43d99c763fe441577287d9ea38950d9c0c488d6ccb15d7ef6bd42298e54f62914e4cc37a7affc60d5ed630d490ae630d905ac5357882458d13e1e143d3ed86196a45507a3fec8aaf538ed46c3fcc0899f20361cb7620ee559fc2d5e59381cf0475702eeadd1cde56495304b553127c8450083cd003c6a28833e5844d6c044b293bea77c2c37f0ba360fdd9df8fe29e975c18a152691b66ec0c48ca023dc2ef1e231f0239093dd85c3ac5c25099480fb45759483f7627b76ae71422352180cefd8aec61dd11fade823d272813eddfdab2c34d69822844457ed47b37249cc1fc1da7e786d0fe8897bada810a775fe63b24becd28553267057cd5a9f967196ca2d26f31a379a45e9046b1d52880393efa7daa5bbfd9709ea28b7c736cca866db084519da5a249d418d6c00291c6d37f3c2688ff4db0d1b29a8af482b7e17d802063b03122e4bab958db144c9ef2ef21b4789a5263a14a15d5e698509f0e1d51a0bb4e37f4a12f8a7dda9e4afe5058abaf7d6d134db578e93debc6b275fbb83833b3fed96def21326626df8e81ca29e5e6538c38afec7740c7b80dfbd57021ea9e268383a08f09ac42cf53ae6df0cdc6605c29496c816b9bfb06dd7314c360fc4d2bea8ca6121eb989ff7a0eaef8b40f77057d5f7111195ce663516842430f3b8725eab2b60988eebb93c2ac5b0cbc0e8751bedeeb2cb728ea23530b14948fcef6c6d16bacc952fdf5dcb5fc281680d9464b549357cd65d26f9a50dd4bbb48f509e4a8e1f9ce73900e61b52e4aa66f7d627e9261e7ae30d5ee7edaa1b31b851718bd66ad72f33f968b2889d7fd9583a490f8f05a45b4f67030dad0773b6ff133fa50eeda36a4f8bd9caed0d0e6acac29992e28194ccb909b5f9f72839960e2a6f773f7e71214c3d6c06dc05660d9084993f8e9775cb27c3514476ab27b07e4942a36cecc24399bcacf9b254dc8de0a14edfff1faa48ee4a86f17b5e7303cf543378f4606664bd7b4ee00bb31869047b1048afbee53489b529e0d4de612f922f0faefc741df7db47a59bf42e14be1db6c54297853cd1cf694368696006f4a2bdf2d8a8ac71bc389f2eead73ec542449e7283f05479363343a121811d67df6130ac6a728668d354fa3fa98ad3ebd266e0c427366d0253e4c470b458551ef46c41764e84f90ea7f680a57f8f63988ee3f44e541139915786f1440858fa343a068f3d5337295b8d6faa846595b0ab536ed9b8eba2a5e79d83074300979573e9630fdc73fd071ee65a1519df075c5496de01ecc80724598e3c65e60b4f07738de5928ad43290c5c166cd510299408a46b29980cc488316d6f4e70b167ecc45ce62faacf3c37e59bd31961830d62b33888e7a4c0a4a294bcde3515a0b4b3312c3ec97a64036368de747b01787e9cceb13bdf08438627772d56be7b3267bb18516ccb7992d8ac18e2d7c93964893403f13c118b3c56d4f749875e85f8cb2188afb420961313cbac5ab21dbd3a8d26bfcf32068b1044079a77a79135064b00f081cd62f5312c251ddaad2c08dacef1e15eab544c6823c73abda1a7532eaa040ace18bd360bb6acbf62677665f1f681b8bac479ae3e29c7c9621ea96a439636a7c6fe2bf67f369b232dec683ed6e638c4fead14927c59a1b8201e3b90cf789128e1cf85f9db332ee539d77a5286ea8bed0cbc82ea219e9d6fc052879cb0e1a0cf78969e24e8fa9fbfd6652deb1f8237d3700810c9d8f85684b12c6f7801f591fc141a2fdf18b88bb4a97fb4f582600b130a34885c734e7abf1b5aaa9049e23118d696cf093f11524cb1c9218d1758b584f65b81b97983d350a6c67f395119716540e67f481b825d3a43213c4d86b4fca718f76625200f011ff5f504bbcb877439b9f222007ad885e6172b21ebf5482d4bd15c39b71fa980f339d141638e71ce602c898b82d6f3ebe2fe46939501a297582f1800e57610fd402297a2887d02cdffafcecf4055668f55ffb2c1a303f0d5f4cd340a6e6ae607c1627a3474835c38270ac2c4787bcbea8b3789299288c5b21a1720146a3aefcc435ea9ecbad7168ecf8e74af571e94335646bbfacdf60bec560565322ddf1359189706da5df598d97569a006d708a96a45e9537d0d6876bbdb69f438fb5f8bfe249870dd15a973d844f2645d36a09c5ad6d68830bab9ddebd683ff2edccec842bfbcff3ad3f4041c116a250650f6b1696f24c0280246b3cda9ee278b40edbd1719187836dc0139e528e6e271ca288477e09371f67c3a6755257498fb6587a24fb33cd6a75453b1ecc374c09d3d15c8d8aaeb356a5dcb8c61232b460d4faf13f842bd57f23f54dc15a3c29c31b659df855c0006fd91e7c7ef04e157c1302a3c9b8f03e26e8f820f42753d96d35f0e2c9b4205a72ddfdc583d8cd08132d5571f20e7ae2fabd40eddb159cf48930823ee81e55d9574ef263d642cb3b355315cb2647b3786050044b0442d5dd7227d338231aa618a6425e34d86fa9e9cabefed142f8d7038fb12c264ff3461e500744e7ed43e0c1b285d24e09c5aac636c222417d76e871825e9eb59552cd78c1a7beede494c351a9b933829f8d8afe1c31d07a3f87972c199cd6db93d0d4df05d6f3ee418a244933b3d013f5f6b7f2bbc44a23a77daef007c5e63beac083557da3957504e631c68294a3c5bc05e28b4a61d86304b36e52e56a6aa51405eca433d7374d022fa61b34df6fb1f648adc7c8e54b6d4b70b4218321e7cdd101c50b2b3fbe749e51b833db3b0f2108011d66a205fe2e520872404edc075defbd4e5ff9932bacd2f1e28d0c64d5d8ce07e587e1662487855103b5c473593292e392181e8609fc6986b3c99013a75c80c7c55689ae7f6ae4d1b3699138eb76b123814b6bdbf592803fcd0cfe1e7cd9a7a8d04ef5ab0cc6c12079452d6232b1aec88b1b2c99f50032b30861f1f0047e0f22fa2412d2052f788b3921f6e19a1a09fb4b319d6fc19662ef69d0b3176e2162d16513f55baa5df8173791a1b6bf8bb1c4a41032beb217102b999ab00b73158c2c91aa07ce08a4d01b7d24128514d830e8d0717dc315d73ee624ffda68d83ac8b2686b126af3e9d549adbf52443733587baaf511589b93e7606be7fefd973cf8e719b08508ac67715a77e4e40be56dfd4f5d173a73527bb900bbc8f61b94cd601261af24e4945b30fed761a101b2a732fa21a8a347041ced5551738ed2ffd822e1090e3b1129c3a569c4eaa298349b73d4a1329c8a91492f053c26378f0e7f5f8e2ba478b14de7a0fb22b7ca3f0c57ef34ad597f77d9e4d52709d0942fd618f47a03c07e32551b47f62b78c2063b08b0e4f06c5bf61a384a2e93df6445166279b3e515e08c41148f49f2e981df4dbe24b8efb52b3a3397a1d8d8ea277404c9516c9aeae255003f8df8ad2bf95eb1087859a55341b6bbfd39a37d26ed5607b465cbe6fcb34e3d456ec6023e8cb1347c1b9d816e32064945740982d16332683d2a106e66c96b7c4301865073bde539820d8c3c87542a7db15da3210a8997d1a163dfda978902e6572f1753913350b0b8d34cc6a5866c31968ae71a0c3110b3b8efd0c1ea9deeb44f9d9176e49576a0c0e9f7ec344de985c8256dad9025b1c94cac913b43388aa8e34191557b024edcfe2c9dde1547946e20e993782f2ca007ca5fc4cc9ecfa40f5f35e8ecde53fd62790c86921246783ebea20bbfcb8c6952bbd0863b7a0acb510f19fd8835184fcbd795fb0f50e1e61ec1544c56e1080eb8e566f507d550380104c82b1e064c6a25b391dc77c774e76532e2866a9f2bfdccc03b627db83556e6247872c56408876011afa0fd746c84d49034d896b555fae2a74d70b176b9ec64416cab9b249822be2a01de20a1157b729c7eab21107f20fab5be9f2644556cdf4ddcdad7438f9e60129a4451486a9eea253d54072e0a0b8b796b3bb7d9008a4616d028966c5078540c248ad5e3433982abb0097975d23ca3a9a7f3a8713cfa4107129d5281ac0b1fc68bf9a865c69b0651e40d6a4b96a71c3d009e4cf309dbffaf2fb0f52920ef473ac4717d7fe5d3b0eca4976c6bb153c5855a1594cd23704be42876e66253c104d69081c8d7f49c0480144623bfb426cf1b55c1af78023fcdcfcc76f411101456982a045e774d3a1ce63bc208374431032a3d95ace5f9d9f2ad390e0f3ca557068db53bcec9ae5f8f20531c5229a92ee9d9d594b6edf0ada953ea27b2289493a907602d25ecb0fd74161a4585b2a89cec0f869cc9130615aaf0952bd71a6f3039731f53f277fb016a18e14a01b4999742c5de7141148697e448fb4f9293ef4e87a716fca9f9ef59cfca10630a099ec8a58e1c92e19f4ecf8c9422107d375b0bbea135e48b0c9baaabaeba4397dc198dac83a656912178bce22569379e9dac575fef89d743d36f4b627a9639cd3649e498270b966c0b5eaa235e7e2b8bf1d26214af7d3649e2a6b9386151c6170c142d0db167cbd4f152ad8f561169c135fe8114fba923e6e70c7060a75344a620b127eea66ce6932e2b4c9952cf18a05faf989b8fa0cfa7e36e3898a4a8e8c98ba5f812e713f0a5d9850f5e991ddb417a7974f68fd4d4e5a8c41f7f0d903108ca374d79000c67f28614c2023c31284bd22cde507dec0e643dfa6b588d870fcaf3182c0064d58d1c27ced135e28ba6ae0a3c09b8f276dbf5bda96b3819218204e88ec1e5c517d87353d6539b3c75bb97922c5ce2b75c4d34070ab15bfb4f4320fc5855c16d405c28d0797af878798187277a899036d7f79efbc062d22f897065989937d0cb1b31b00"}}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48e, 0x0, 0x40}]}) executing program 9: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_ACT={0x30, 0x3, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) executing program 9: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) getsockopt(r2, 0x111, 0x4, 0x0, &(0x7f0000000080)) executing program 9: pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0) tee(r0, r4, 0xf3a, 0x4) write$binfmt_elf64(r2, &(0x7f0000000380)=ANY=[], 0x18c6) executing program 9: r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000040)=ANY=[]) executing program 4: r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0x1, 0xb}, {0x7, 0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000200)=0x9) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000500)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200c8084, &(0x7f0000000080)={0xa, 0x4e28, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) executing program 3: r0 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xc3) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xe6) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xffffffffffffffff) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd2b, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xffe0, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x7fff, 0x7, 0x7, 0xff07}, {{0x2, 0x1}, {0x4, 0x1}}}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x24000000) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000180640fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e224e22", @ANYRES32=0x0, @ANYRES32=0x41424344, @ANYBLOB="601810"], 0x0) executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000001007b"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000000)=0x3, 0x4) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=""/23, 0x17}, 0x80009}], 0x16c, 0x10002, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r2, 0x61646, 0x3020}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x480) executing program 3: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x8820) executing program 4: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1b}}, 0x20) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000040), 0x4) read(r0, &(0x7f0000000080)=""/135, 0x87) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00100000000000000000000c000f"], 0x6c}, 0x1, 0x0, 0x0, 0x40811}, 0x20) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)={0xe5, 0x0, [{0x80000001, 0x2, 0x4, 0x8001}]}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r3, 0xffffffffffffffff, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dvb_frontend-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-ioctl$FE_GET_EVENT-ioctl$FE_SET_FRONTEND detailed listing: executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash single: failed to extract reproducer bisect: bisecting 68 programs with base timeout 1m40s testing program (duration=1m57s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 32: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125b2ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb03bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c2e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2033aae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b85b7b26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1111c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c669bb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b2967cbfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d6748c2ce5bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4658098549646bd63175adf77b5cdcf102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4baea02fa76fb4830aebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f8426a9049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21abfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e0068607000000fb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9fb4000000f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002afea6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b46e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae66444a8f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a00", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x13, r0, 0x0) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x1) ioctl$FS_IOC_READ_VERITY_METADATA(r1, 0x2201, &(0x7f00000000c0)={0x2, 0x6, 0x0, 0x0}) executing program 33: r0 = fsopen(&(0x7f0000000040)='binfmt_misc\x00', 0x1) r1 = fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x1, 0x3) executing program 34: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000100)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x2, 0x0, 0x2b}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x802d, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e20, 0x4e20, 0x1d, 0x0, @gue={{0x1, 0x0, 0x0, 0xff, 0x100, @void}, "b68ed34f131c03e57e518e4d0800000040"}}}}, 0xfdef) executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r1, 0x4004480d, &(0x7f0000000080)={0x5, "1f7f67491b5a90eeaddb94a4031a82687063ba6e44f7b91d902d0008424ad04b9634bef178be4ba64223a1d6da6d232b4ea6a453724e5a9c45a204ec36715596"}) executing program 5: r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000340)) close_range(r0, 0xffffffffffffffff, 0x0) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x3ff8, 0x0, 0x0, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x61637876) executing program 5: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x44000, 0x0) executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x400}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x800) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB="240000000104010200000180002000000100000008000540efffffff0500010001"], 0x24}}, 0x0) close(0x4) executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x80000000, 0x4) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x40, 0x3a, 0x0, @private0, @mcast2, {[], @dest_unreach={0x1, 0x1, 0x0, 0x0, '\x00', {0xd, 0x6, "310300", 0xf4e, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @private0={0xfc, 0x0, '\x00', 0x1}, [@fragment={0x3a, 0x0, 0xc, 0x0, 0x0, 0x1, 0x68}], '\r\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x1000}], 0x1, 0x40012040, 0x0) executing program 35: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0)=0x80000000, 0x4) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x40, 0x3a, 0x0, @private0, @mcast2, {[], @dest_unreach={0x1, 0x1, 0x0, 0x0, '\x00', {0xd, 0x6, "310300", 0xf4e, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, @private0={0xfc, 0x0, '\x00', 0x1}, [@fragment={0x3a, 0x0, 0xc, 0x0, 0x0, 0x1, 0x68}], '\r\x00\x00\x00\x00\x00\x00\x00'}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x1000}], 0x1, 0x40012040, 0x0) executing program 7: r0 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000040), &(0x7f0000000000), &(0x7f00000002c0)='s', 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain={'key_or_keyring:', r2}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain={'key_or_keyring:', r0}) executing program 7: setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x0, 0x0, 0x1, 0x0, 0x100}, 0x1c) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) executing program 7: syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009bbd8b08e80430ffd1a601220301090222000100000000090400000129fddd000905e2ffbe"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000000)={0x1c, 0x2, 0xeffe, 0x9, "8d510291002a49500d000080009b1dffff6a1d73f2000000fffffffc00fbf29c"}) r1 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x1c, 0x2, 0xeffe, 0x9, "cd511591002a49500000008000000000f86a1d73f20000000000000000fbf29c"}) executing program 8: r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000105804105000000000000109022d00010700000009040005050300000009210002080122940309058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="add124a0c9a43b2292136226b5ba7ada5317f080e8b9"], 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@getsa={0x28, 0x12, 0x20, 0x70bd26, 0x25dfdbfb, {@in=@local, 0x4d2, 0x2, 0x3c}}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) executing program 7: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89001) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xc) executing program 7: openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x121a02) r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xb38a, 0x80, 0x8002, 0x272}, &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x4, 0x8, 0x0, 0x0, 0x4, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x101, 0x11, 0x5, 0x0, 0x0) executing program 8: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'macsec0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r1, {0x5, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040054) executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x6, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "715150b1971bbe75", "8c419c4cb217d59a5e2108c76ca18dad", "8869fdbb", "ddc7586e28e54682"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) executing program 36: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x6, @loopback, 0x101}}, 0x0, 0x0, 0x48, 0x0, "8e4ed5b6cd6e3a3be2da5590ede383d2d7ac8deb4a44299f9f0cf768192aed7631289c5d29a3aa7c5c772f383a909e691eb2eddd4322253d1e303a96c995b3e2189cf625a0720ad0fdf0917e7d9e57d5"}, 0xd8) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "715150b1971bbe75", "8c419c4cb217d59a5e2108c76ca18dad", "8869fdbb", "ddc7586e28e54682"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x58) executing program 8: r0 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f00000001c0)) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000d1a000/0x2000)=nil, 0x1, 0x0, 0x0, 0x237, 0x0, 0x2, 0x0, 0x2}) executing program 8: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89001) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xc) executing program 8: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r0, 0x0, 0x0, 0x80800) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x1) executing program 8: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 1: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 39: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 2: r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x1) r1 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r1, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r2) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='lp', 0x2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) executing program 0: renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0x76, 0x101341) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0x12d) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0x80045515, &(0x7f0000000100)=@usbdevfs_driver={0x80000001, 0x6, 0x0}) executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x200, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x4, 0x8, 0x409, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) pread64(r0, &(0x7f0000000700)=""/115, 0x73, 0x5) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x8}) close(r0) executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206030000000000000000000000000011000300686173683a6e65742c6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007800800084000000078050014"], 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0x122, @tick=0x7, 0x0, {}, 0xfc, 0x0, 0x8}) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x0, 0xd13a5dbb099f029b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: io_submit(0x0, 0x0, &(0x7f0000000140)) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040ba124b0700000000000109022400010000102c09040005010300010009210080090122180009058103"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 9: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000340)="1735", 0x2, 0x240148c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x10022, 0x0) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x5, 0x8, 0xffffffff, 0x7}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000006000)=@vmx={0x0, 0x0, 0x2080, {0x54000, 0x8080000, {}, 0x1, 0x6}, {"cfe274ab958596a18f48df8c02940a5f500fb5b3c7c98a8f1bab36eedb7479373c8e69e784da80d6f072c0e004dc9b1e1e55341fbc56e170067b1cc38d2b253298bd202f2e123d5648d7c52fe8d4ae4f2658e7fade39ca34735a5dda720272b7dd244c887ef38ab2e1f76903c3e17a5b9a4a39b439833517e44fdafb5ec17fcee283ce983ad4332b583a1261cc30690a4f91f8676865ed446d6fdef42a9e0407d0dbe32716b6743e01bc02527c0e0afa7ad94f4cf53f4b9d4be36ca2d48f8ceafedd9f65898c3811c23eb05666241ebd78b7a476b5a6aebf38780257e5d150c1c88433569aff06305d5306161adf35899e4bd72b1c84c602b16eff131f30a06c20da4747ce17482d42fc241a3133d01463215de68c845f90a6998e9129f22f4140a47d225585ac94000f1cc8a55f3b381cdd71bd57652f063be52b4dd6679fb43d3a6fbf74abdf79ab07a8e289dee138c9c504bf787b188217111f81679394236aa10b47003834f9b5e05486f11d3ad525119c7d6c6290181c351b857f4cfa302d6ef2ee89f5a68201014de2e1dbddc1b67b67e17a9a6d4531092120470686449a2cab9a737c5e04accb6067d046f7ecbd1b745b58dd15879c1ea48faf012fc03501d167637c7b78d47299ae76537996f36a272766c3f2ff2cd7dfa6e0d813c41cc633478d74ee5dced5ee788f11b7d75926d22eefe7a8b6be5d55ef759769f595a6390cca7702871c34d889eafd379fd6df37677c0f5e060ed8890b4e8079e598c71c687130795d66fc3c50bded002e3cd07fed23fe008809646f0b0b349a0420eee2077dedca495cf22a9376811032388c7e9a218200881a2408a2dc3644b11b3e709a450e1da7caf79d221671f2e4332054d3118bc84fa4ebcf30fa6a5477638ef92158ec38808bdc1520621b6b1885618eaf456b65adfd1ec5db0d070e767ed7aa95f3b7f1b61cf63909f5f556ac9c82278ad43db0d15f09a6d36942fdd4100aa3f34ee28ff77e05216770295dca0a6eb60aeb98935fc7af6df76ff5215c19c10361fb99ee4b3a3f38acd749e26256152d9cad7ab95bccadca1916941987b23c4ee9e56325a973c0afd1fd7f92e3cfe5f32f4b16144e6b88d6ad1977e7367d7545c0f3b4202045bf2eef2f6c3df29d3d3ed10e20f0b2d5695421220eafc9b270261aec292f5edc0f7a8aea41be384ff81aff8c44f07cb75b0549c316ed300c80d34cb269b043843f3e39d5ad4aa8d27825fd1ea49fc4415889c71446b33389b042aa59be1fc85ec0b4748f36a37054d54c518787f37366b629ec8802d0a853f520025a25e410b4a5014fb9ee3fd83b839722110c3909c73c78a09d8919c04da7ca27c2083766b2b38f97f0a41822e6ad881055defbac2c9a8aa1b46b598a39fd5d40ff921b956115914fd34db7d8d781a27dfc69df20555b5f80b25d8d7d8e01afa1180b7f65272d149a5f0d80d6a22798a6c6fbeac2c817505fd32d40c7e5a04c56abc78fe9c004364c00920edba0a59dab84e6b44df825660fc843315ab9d184cb46fc7dbf87c4e1e332d9e608f0849e160195e0edbc31ffef22543754df8905e5768fcb0cb190e5f047fab6c41044e74f5b1070bf1b0d4a8cb94f92e270eee0962e980206c07da947b41474f004089e65a95946282cceccc0a92a3ac45f37dcc93f51d04f669049a06d98340834d19042855aadff35bd47de85fea05a17ab1edc312eb40400645e8e12906e4de1a27adcb28a57db5281e48a02441b7cb1dfcee0fd8d5f868942baedbc1f83dfebc8ada3ab643f18b326f09f56e2c336af81169634ed1ffc178f655475090a2a00b68b83dec9ddde6ecd017edddde191e1461ae78856f369c7ea7fc08830f84a369cab38ef3f2657992efca64222ee289ca30698457232ee8c30d13d58aaa5876fe66d3146ff584a6c51ddf8784c6099453e6e847a263e54ae6c03fd6fb4380639d2b850fb8bde3794883dfe672e30343a5505db047c31b57e4afd79f9f7423020aec0efb61e4ad76f149fcb5564de26602b228b8fd9b82238a658b70268628abd7936690e2fce88ab6bda0cb75bc94188081d42ac369d313e73f71d8bd0a773d23ca93d81d1f2f65d8a2b72d5c5c4f8fe244dd49ad253b69c07f673c0a6b56f51fd315568f001c63cb22f43ef8cc8d6d50ccb07c89075f4beb575aa8e95bbfeb946a428a36ef6e7388f2f03de8fc958d2cade4e8c16308f92fe65f122f580c83e69566fc683022003528b332be2bb324894dcabca0ad4886c2b7dcff3f9fac5a93e2103012493874aecb1849be62834891f87863cc6647f7881ec3d05f82203c1dee4347f65e8076cfecbd62baf7b1da7862964178b759f3bcbd53e91750ad1d9d70189c1b8c929dae459c5bc2a51fb01a47a06ec34ded19c50f8d2a53c6dceabff41242070c7745437967b0b39bc4213c25eadf9da3c8019905b21076d20d985705778521cf5b93f8800b06d1db31761b3d2d7d583d7b37407d1e08749b5c8009c8af72de1fb7f8468c79f9efb6b15a72ec770a73940675786539ddc2395fda8654e5062758faab10693fba92eefd2aad723d6565773f74c961e42934dddabfb4da790d9e4f18310768867363d7231a80c4953fd250a8b62be3f4853afc2a7faf537870f0a2388af5ccad3b2b62faa47c0d555f02120aa16af41278da51128ea14a2665019a5d34c79ffca9ae789034adbc56c8a73ceb0f1ebbf540723fab2ba52bf18a33ee20ecd38721860809da674e07046fcf3a7565aac21b27062b2c1e26ed6c006447e4b237948701e05d6b30d1983bc4b5fc575e05734052f4440f615cc135a38d811d008578fc35037a25b2f8b4b5bf483d174043d02faa8af4ed3c522a289f61f5b46c713d22645657015f323281ad0e6043326dd1fc9070185288edd97d5a076c2ecd331930af8a5651d05c5a7fa8700a7ce1ea8241ecc50a1c20f5315a4a7494ed0817808f3075745dbcf492142632c9a8d8a06ea490eecadc32fd962b244feec473e92012fd51b8697b3c5fdff1785fee23e240658696db5e9f1ece878c4e609593946b320b657fee3f3c8632e7c80a937d2b16a22c01bafc86da04b8bf08d93d2027d1feb37c355434696fd892378c74e3a4b0866125b4647e595e3716b8f7bf1430b31bc9999963be069f513876bc3f6cc10b74e6941089791f14e032133663174ab2e5fb4ab61e77c3e302ae5ad774d9cde9520395a087b3230150c14beadac595e03bf24faaa4f783f298ebdd4f1f797c0e57763b2341c143547488b975a586abc582b03c44398ebed8a91b0dcf6db7c2e529a78197feb8d5c3efa167cb9e7561f59913c7f670375e22bea287efcc2d752588f3dbd20467859404f235eab1ff551a68844790154f1f64a09eb846643cd912fdd536a182efd02165f75a730b0e8d120af8759405fc114c23ed038de55ef5888466d9403fa309b593c126e04baae5b19a160324c58d5b7f448b1fa19f69042c5729af96a4f397d1e0d94470176ab051fba1d42058d07baebd3938c3a91a18432be62aac2805083d0452d2c3f0f70ccda5236f2455273565ed876f0e4581c34003683af5d1b3a3c57d369c7bc44850ef6f5a0d7007d5ca2771200bb1407587b117321d7bb8cbe4e0030d23c1f1571e030037d3a65413598f192a7500d3bb09fc1886f43ba5864fe47c369c1adff320bf2a2d11a74af76d8b8327de8f0be24591901408a532c26186b210a83c4c4d6aa799ef5add3146aa07310352791d1fc151bad89c9a28f3289ccea80ad713974609c2883b8871ef4a5fd9d5f1d754e580cf0ecff281b4fb3d6b969881e085fcdf84b909eb370d24351ddbd68adfb8ec199a4278d0ef57c31376939469d41578891729a8e20911e15367c369392293f9bb25d8828d22bf679ef33b0ba9ce574d854a4e916618db649b3b24dc6d66311c1daef9a6de6bbb2f3bee14f6509c2e7d53c1f37fad8f2a4b238c57a4c3015f68f8d750850e61ee6133f14e2a17bac58138938aa0cb8139cf6b361879b9633ec25282e9a4586d1f633839b13c60e8181e7dfff7634d12b379795292c71e00f49ddc82c2bfdda96a7df8be5cdf12b95491c28183efcebdacc6c4fa729f5fb7b5c84bb22dd502ac9e749b1e9fea78f7ffc8e55411f72cd628d7dbd1a7cc67689ed68c7fa144103a3157b329f13191904cc6db29e2d6c672c9132dec1e1e784e0e0b22688884dbff9e82c83a1001b13ccf1e06722e9a18f62e6727b4154beade00fe9b76fc504a74f8e212b96f2ddc3421211bb61e5e16931ed0b3c2e03e898f1d4cc619b127e195bbe51a3efc4bbca90126cda7c4fccba3e9069e80692497fff522a9aaeb93064282b21d0455ac14da7c0fbae48924a567425a0fe13a76edc0d4edc46489a54cf39631fc7f98eb3daa6a3b8ff7b648d8ad9444d915c1204ab669eb6e715822592ed6673ee6992f32d259458d4becc02fd57f249569de6880632edc42d9b3a15b877981a6d807a661511ec3cb5bfa017b66cff803b44914fb4cb309c4fdeb1632c26c78bc480843e7376bcf95a6acc2fb6b21aee33641dfc0ad8292586b4deb7c09452a99effcb65ac49b68b2bc47d3620d36389a094d628ade5c907fb15abb3441f95703f66c1022fe6556f85dff37e8cc543341ec8f50f53129b1f01a8610efcb9e5c4c5a5b721f1f8bfcc17f139c5eeec9f102e605872b75851ab1102095dc23670c7d2224d308bd688e49c353ddac2833e619e06d9edeb8d427259377164764dee15d3afce445350e6a281305ffce2858217d214bf6517ec677ea79ae84a483ccd022fe0c21bc7923bdad51e0f5b17369f9e3969b5c30924b522cddc0fb221e36a325e383f62355e4677fcd8a8f228546e4c7cf41b109a0136156a4f0426e9ad9f821c4f0b9fd036b20f9bc612838e63bd5db4f1f2654dbc5484268567a7c55d91a5d40156489154f5513ec5b0ca928c00a251c7f5c7e008cd72ae0815a8ff081d15729f3b66a8aa731f491b877916d19c528bbc2c388b1d4f1d6a9a21f621a24075d332e20febc385a68d3c01d2aae555a03ff8bfd61823b12f7b6c3fa939b9cdfaa498c0a9a9ec0927e0fa119ac03f54613ae42a51a569f790e49c30fe9efdd43e18da9663592a44d7986735281c473d94ae7858a1d6260797d08af52a5942faf767a389d8a6b509c12a411b19bcd6898f4f7484435770e4932b036aca20636b5f2765264684694606a71b70843b8cc0972d772c8c7435450ba8f6b63eba3690cfdc8f002dfa31df2e54b6066fed99241eeca470f4d7acc647e51f8ae2152842f28864ffb8a7e843ba895c7a7f1922ed79da68412ba76e22cb2e0bd8cd4483314f20cb14fe89595a03eef031d846c3fdfa7eb49fdd5d60d30ffa9fae4817a98737c9d7a83c9074daf02eece73d4506019ce6d65d8d3889c3510c3985b85ed6a9d3d660cb2260b9b78758295109b135ce79ade8b75619e952ca2a0fe1670a461f47dfc6aa6d85c332ed9f37afcb1d9fa6364c15947b281ecffbf8895ff4f5343877599c64f7b105865f0988e347d56a45045529d9f99f79d756f2b618a3fe580bc66a11f8c2a5f577bd801690ac3d7a9bdcc49db3155c5819144afa6c5626bdbc1f9410fcaea346490570c0e21ebc62d1791a24cbcd302912a14a1b494249c2b7347904db109310157c0aee443f04e20451a5a9486aeb0521831dbfbac1f716fb956c03bdaf7723623edbc80c0fe2afd236760978b381a5a865a3bf27e3e7e28a107d0d185d3b00", "74485c02cc3d2feede8f343ae164753039c041dc8e83cbb16678625e308951b919ec42532b0ddebf7bd568e938d258f3ee00d3c529fa5056f3c4ba54a8a4a57e03b62d308475e0403e0169eae259f614fdb3572e19dacebbff87a37f3fadc45c37fa5c0ada4ad4777018737d1a633402cb48311c00a365ea9d15d383e5a9a1b8510350d8e353ba46ab94629d2c9d865b5ab0142faa11b9b3b75a010c3fa12fb17b7f22889d64516b98ecb1d3d5abdd1a9065ea3c61b75a381ca3fc72833aeb3ce266350618d35206a9fd47328077a3407f75b965a36f422cb7ccf0cdd3320bc89f8d43f54db8ad280d988f31e4bd2e0b349207c746737eaec5763673e460d3fc1ca92e147c0c0076b5ee01ef09015936e5ff2a722b0f30b853de48db22251fff8db43f5aff7cfda61aa8a30acc52547fc4f1ba86d65c5cff8a8fd4f14292d647e41fd91a8926f5ce0a92a217b47cb4a01eb1fe44da0badaa18e63df95ebd492401e4f19c351a77b4915d14dc0903ffd196bdb3bae0841dabd83c3bd336d2eb8d2b1d52e351cf1d13d2556bec6c3773cbc8326a5b1e029a9a0d5501e8615e8a2693097c32cf504806c94bd6292a0e9c273bdb7418bcd6dcab07fde463d85b0ae7a273adbfa7a6bcaf62f59d9ceb5b90ddf2fa09335e2499bc18a1c0ec28f83424571022f6e03e4b06c96ae14d25ed4655c30be46ab30ad742380a4733782ec29fcb17b0c42a18ec98d39143679cf6021e1866eb78d734417a7a90fe94ff1f7d63252a3f2f552f61d5629c4834e144a83dbf47753770fa1169a9d7581b2d2f913048d1019c35a993d20803435696eaf879060c03c1fc133773db22f0dd29064129e87bb4cb810afa8b3a4c211f5ed4ee82e542c1802001ccdd2cf4bb44655bbc18bdd810dec8bf439880402573a58ec5d98dffe37bdda12610d78ca9149111b67682f563efd0ff43d99c763fe441577287d9ea38950d9c0c488d6ccb15d7ef6bd42298e54f62914e4cc37a7affc60d5ed630d490ae630d905ac5357882458d13e1e143d3ed86196a45507a3fec8aaf538ed46c3fcc0899f20361cb7620ee559fc2d5e59381cf0475702eeadd1cde56495304b553127c8450083cd003c6a28833e5844d6c044b293bea77c2c37f0ba360fdd9df8fe29e975c18a152691b66ec0c48ca023dc2ef1e231f0239093dd85c3ac5c25099480fb45759483f7627b76ae71422352180cefd8aec61dd11fade823d272813eddfdab2c34d69822844457ed47b37249cc1fc1da7e786d0fe8897bada810a775fe63b24becd28553267057cd5a9f967196ca2d26f31a379a45e9046b1d52880393efa7daa5bbfd9709ea28b7c736cca866db084519da5a249d418d6c00291c6d37f3c2688ff4db0d1b29a8af482b7e17d802063b03122e4bab958db144c9ef2ef21b4789a5263a14a15d5e698509f0e1d51a0bb4e37f4a12f8a7dda9e4afe5058abaf7d6d134db578e93debc6b275fbb83833b3fed96def21326626df8e81ca29e5e6538c38afec7740c7b80dfbd57021ea9e268383a08f09ac42cf53ae6df0cdc6605c29496c816b9bfb06dd7314c360fc4d2bea8ca6121eb989ff7a0eaef8b40f77057d5f7111195ce663516842430f3b8725eab2b60988eebb93c2ac5b0cbc0e8751bedeeb2cb728ea23530b14948fcef6c6d16bacc952fdf5dcb5fc281680d9464b549357cd65d26f9a50dd4bbb48f509e4a8e1f9ce73900e61b52e4aa66f7d627e9261e7ae30d5ee7edaa1b31b851718bd66ad72f33f968b2889d7fd9583a490f8f05a45b4f67030dad0773b6ff133fa50eeda36a4f8bd9caed0d0e6acac29992e28194ccb909b5f9f72839960e2a6f773f7e71214c3d6c06dc05660d9084993f8e9775cb27c3514476ab27b07e4942a36cecc24399bcacf9b254dc8de0a14edfff1faa48ee4a86f17b5e7303cf543378f4606664bd7b4ee00bb31869047b1048afbee53489b529e0d4de612f922f0faefc741df7db47a59bf42e14be1db6c54297853cd1cf694368696006f4a2bdf2d8a8ac71bc389f2eead73ec542449e7283f05479363343a121811d67df6130ac6a728668d354fa3fa98ad3ebd266e0c427366d0253e4c470b458551ef46c41764e84f90ea7f680a57f8f63988ee3f44e541139915786f1440858fa343a068f3d5337295b8d6faa846595b0ab536ed9b8eba2a5e79d83074300979573e9630fdc73fd071ee65a1519df075c5496de01ecc80724598e3c65e60b4f07738de5928ad43290c5c166cd510299408a46b29980cc488316d6f4e70b167ecc45ce62faacf3c37e59bd31961830d62b33888e7a4c0a4a294bcde3515a0b4b3312c3ec97a64036368de747b01787e9cceb13bdf08438627772d56be7b3267bb18516ccb7992d8ac18e2d7c93964893403f13c118b3c56d4f749875e85f8cb2188afb420961313cbac5ab21dbd3a8d26bfcf32068b1044079a77a79135064b00f081cd62f5312c251ddaad2c08dacef1e15eab544c6823c73abda1a7532eaa040ace18bd360bb6acbf62677665f1f681b8bac479ae3e29c7c9621ea96a439636a7c6fe2bf67f369b232dec683ed6e638c4fead14927c59a1b8201e3b90cf789128e1cf85f9db332ee539d77a5286ea8bed0cbc82ea219e9d6fc052879cb0e1a0cf78969e24e8fa9fbfd6652deb1f8237d3700810c9d8f85684b12c6f7801f591fc141a2fdf18b88bb4a97fb4f582600b130a34885c734e7abf1b5aaa9049e23118d696cf093f11524cb1c9218d1758b584f65b81b97983d350a6c67f395119716540e67f481b825d3a43213c4d86b4fca718f76625200f011ff5f504bbcb877439b9f222007ad885e6172b21ebf5482d4bd15c39b71fa980f339d141638e71ce602c898b82d6f3ebe2fe46939501a297582f1800e57610fd402297a2887d02cdffafcecf4055668f55ffb2c1a303f0d5f4cd340a6e6ae607c1627a3474835c38270ac2c4787bcbea8b3789299288c5b21a1720146a3aefcc435ea9ecbad7168ecf8e74af571e94335646bbfacdf60bec560565322ddf1359189706da5df598d97569a006d708a96a45e9537d0d6876bbdb69f438fb5f8bfe249870dd15a973d844f2645d36a09c5ad6d68830bab9ddebd683ff2edccec842bfbcff3ad3f4041c116a250650f6b1696f24c0280246b3cda9ee278b40edbd1719187836dc0139e528e6e271ca288477e09371f67c3a6755257498fb6587a24fb33cd6a75453b1ecc374c09d3d15c8d8aaeb356a5dcb8c61232b460d4faf13f842bd57f23f54dc15a3c29c31b659df855c0006fd91e7c7ef04e157c1302a3c9b8f03e26e8f820f42753d96d35f0e2c9b4205a72ddfdc583d8cd08132d5571f20e7ae2fabd40eddb159cf48930823ee81e55d9574ef263d642cb3b355315cb2647b3786050044b0442d5dd7227d338231aa618a6425e34d86fa9e9cabefed142f8d7038fb12c264ff3461e500744e7ed43e0c1b285d24e09c5aac636c222417d76e871825e9eb59552cd78c1a7beede494c351a9b933829f8d8afe1c31d07a3f87972c199cd6db93d0d4df05d6f3ee418a244933b3d013f5f6b7f2bbc44a23a77daef007c5e63beac083557da3957504e631c68294a3c5bc05e28b4a61d86304b36e52e56a6aa51405eca433d7374d022fa61b34df6fb1f648adc7c8e54b6d4b70b4218321e7cdd101c50b2b3fbe749e51b833db3b0f2108011d66a205fe2e520872404edc075defbd4e5ff9932bacd2f1e28d0c64d5d8ce07e587e1662487855103b5c473593292e392181e8609fc6986b3c99013a75c80c7c55689ae7f6ae4d1b3699138eb76b123814b6bdbf592803fcd0cfe1e7cd9a7a8d04ef5ab0cc6c12079452d6232b1aec88b1b2c99f50032b30861f1f0047e0f22fa2412d2052f788b3921f6e19a1a09fb4b319d6fc19662ef69d0b3176e2162d16513f55baa5df8173791a1b6bf8bb1c4a41032beb217102b999ab00b73158c2c91aa07ce08a4d01b7d24128514d830e8d0717dc315d73ee624ffda68d83ac8b2686b126af3e9d549adbf52443733587baaf511589b93e7606be7fefd973cf8e719b08508ac67715a77e4e40be56dfd4f5d173a73527bb900bbc8f61b94cd601261af24e4945b30fed761a101b2a732fa21a8a347041ced5551738ed2ffd822e1090e3b1129c3a569c4eaa298349b73d4a1329c8a91492f053c26378f0e7f5f8e2ba478b14de7a0fb22b7ca3f0c57ef34ad597f77d9e4d52709d0942fd618f47a03c07e32551b47f62b78c2063b08b0e4f06c5bf61a384a2e93df6445166279b3e515e08c41148f49f2e981df4dbe24b8efb52b3a3397a1d8d8ea277404c9516c9aeae255003f8df8ad2bf95eb1087859a55341b6bbfd39a37d26ed5607b465cbe6fcb34e3d456ec6023e8cb1347c1b9d816e32064945740982d16332683d2a106e66c96b7c4301865073bde539820d8c3c87542a7db15da3210a8997d1a163dfda978902e6572f1753913350b0b8d34cc6a5866c31968ae71a0c3110b3b8efd0c1ea9deeb44f9d9176e49576a0c0e9f7ec344de985c8256dad9025b1c94cac913b43388aa8e34191557b024edcfe2c9dde1547946e20e993782f2ca007ca5fc4cc9ecfa40f5f35e8ecde53fd62790c86921246783ebea20bbfcb8c6952bbd0863b7a0acb510f19fd8835184fcbd795fb0f50e1e61ec1544c56e1080eb8e566f507d550380104c82b1e064c6a25b391dc77c774e76532e2866a9f2bfdccc03b627db83556e6247872c56408876011afa0fd746c84d49034d896b555fae2a74d70b176b9ec64416cab9b249822be2a01de20a1157b729c7eab21107f20fab5be9f2644556cdf4ddcdad7438f9e60129a4451486a9eea253d54072e0a0b8b796b3bb7d9008a4616d028966c5078540c248ad5e3433982abb0097975d23ca3a9a7f3a8713cfa4107129d5281ac0b1fc68bf9a865c69b0651e40d6a4b96a71c3d009e4cf309dbffaf2fb0f52920ef473ac4717d7fe5d3b0eca4976c6bb153c5855a1594cd23704be42876e66253c104d69081c8d7f49c0480144623bfb426cf1b55c1af78023fcdcfcc76f411101456982a045e774d3a1ce63bc208374431032a3d95ace5f9d9f2ad390e0f3ca557068db53bcec9ae5f8f20531c5229a92ee9d9d594b6edf0ada953ea27b2289493a907602d25ecb0fd74161a4585b2a89cec0f869cc9130615aaf0952bd71a6f3039731f53f277fb016a18e14a01b4999742c5de7141148697e448fb4f9293ef4e87a716fca9f9ef59cfca10630a099ec8a58e1c92e19f4ecf8c9422107d375b0bbea135e48b0c9baaabaeba4397dc198dac83a656912178bce22569379e9dac575fef89d743d36f4b627a9639cd3649e498270b966c0b5eaa235e7e2b8bf1d26214af7d3649e2a6b9386151c6170c142d0db167cbd4f152ad8f561169c135fe8114fba923e6e70c7060a75344a620b127eea66ce6932e2b4c9952cf18a05faf989b8fa0cfa7e36e3898a4a8e8c98ba5f812e713f0a5d9850f5e991ddb417a7974f68fd4d4e5a8c41f7f0d903108ca374d79000c67f28614c2023c31284bd22cde507dec0e643dfa6b588d870fcaf3182c0064d58d1c27ced135e28ba6ae0a3c09b8f276dbf5bda96b3819218204e88ec1e5c517d87353d6539b3c75bb97922c5ce2b75c4d34070ab15bfb4f4320fc5855c16d405c28d0797af878798187277a899036d7f79efbc062d22f897065989937d0cb1b31b00"}}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48e, 0x0, 0x40}]}) executing program 9: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_ACT={0x30, 0x3, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) executing program 9: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) getsockopt(r2, 0x111, 0x4, 0x0, &(0x7f0000000080)) executing program 9: pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0) tee(r0, r4, 0xf3a, 0x4) write$binfmt_elf64(r2, &(0x7f0000000380)=ANY=[], 0x18c6) executing program 9: r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000040)=ANY=[]) executing program 4: r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0x1, 0xb}, {0x7, 0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000200)=0x9) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000500)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200c8084, &(0x7f0000000080)={0xa, 0x4e28, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) executing program 3: r0 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xc3) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xe6) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xffffffffffffffff) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd2b, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xffe0, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x7fff, 0x7, 0x7, 0xff07}, {{0x2, 0x1}, {0x4, 0x1}}}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x24000000) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000180640fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e224e22", @ANYRES32=0x0, @ANYRES32=0x41424344, @ANYBLOB="601810"], 0x0) executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000001007b"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000000)=0x3, 0x4) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=""/23, 0x17}, 0x80009}], 0x16c, 0x10002, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r2, 0x61646, 0x3020}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x480) executing program 3: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x8820) executing program 4: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1b}}, 0x20) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000040), 0x4) read(r0, &(0x7f0000000080)=""/135, 0x87) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00100000000000000000000c000f"], 0x6c}, 0x1, 0x0, 0x0, 0x40811}, 0x20) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)={0xe5, 0x0, [{0x80000001, 0x2, 0x4, 0x8001}]}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r3, 0xffffffffffffffff, 0x0) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: bisecting 68 programs bisect: split chunks (needed=false): <67> bisect: split chunk #0 of len 67 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m51s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 1: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 39: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 2: r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x1) r1 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r1, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r2) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='lp', 0x2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) executing program 0: renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0x76, 0x101341) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0x12d) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0x80045515, &(0x7f0000000100)=@usbdevfs_driver={0x80000001, 0x6, 0x0}) executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x200, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x4, 0x8, 0x409, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) pread64(r0, &(0x7f0000000700)=""/115, 0x73, 0x5) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x8}) close(r0) executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206030000000000000000000000000011000300686173683a6e65742c6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007800800084000000078050014"], 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0x122, @tick=0x7, 0x0, {}, 0xfc, 0x0, 0x8}) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x0, 0xd13a5dbb099f029b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: io_submit(0x0, 0x0, &(0x7f0000000140)) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040ba124b0700000000000109022400010000102c09040005010300010009210080090122180009058103"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 9: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000340)="1735", 0x2, 0x240148c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x10022, 0x0) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x5, 0x8, 0xffffffff, 0x7}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000006000)=@vmx={0x0, 0x0, 0x2080, {0x54000, 0x8080000, {}, 0x1, 0x6}, {"cfe274ab958596a18f48df8c02940a5f500fb5b3c7c98a8f1bab36eedb7479373c8e69e784da80d6f072c0e004dc9b1e1e55341fbc56e170067b1cc38d2b253298bd202f2e123d5648d7c52fe8d4ae4f2658e7fade39ca34735a5dda720272b7dd244c887ef38ab2e1f76903c3e17a5b9a4a39b439833517e44fdafb5ec17fcee283ce983ad4332b583a1261cc30690a4f91f8676865ed446d6fdef42a9e0407d0dbe32716b6743e01bc02527c0e0afa7ad94f4cf53f4b9d4be36ca2d48f8ceafedd9f65898c3811c23eb05666241ebd78b7a476b5a6aebf38780257e5d150c1c88433569aff06305d5306161adf35899e4bd72b1c84c602b16eff131f30a06c20da4747ce17482d42fc241a3133d01463215de68c845f90a6998e9129f22f4140a47d225585ac94000f1cc8a55f3b381cdd71bd57652f063be52b4dd6679fb43d3a6fbf74abdf79ab07a8e289dee138c9c504bf787b188217111f81679394236aa10b47003834f9b5e05486f11d3ad525119c7d6c6290181c351b857f4cfa302d6ef2ee89f5a68201014de2e1dbddc1b67b67e17a9a6d4531092120470686449a2cab9a737c5e04accb6067d046f7ecbd1b745b58dd15879c1ea48faf012fc03501d167637c7b78d47299ae76537996f36a272766c3f2ff2cd7dfa6e0d813c41cc633478d74ee5dced5ee788f11b7d75926d22eefe7a8b6be5d55ef759769f595a6390cca7702871c34d889eafd379fd6df37677c0f5e060ed8890b4e8079e598c71c687130795d66fc3c50bded002e3cd07fed23fe008809646f0b0b349a0420eee2077dedca495cf22a9376811032388c7e9a218200881a2408a2dc3644b11b3e709a450e1da7caf79d221671f2e4332054d3118bc84fa4ebcf30fa6a5477638ef92158ec38808bdc1520621b6b1885618eaf456b65adfd1ec5db0d070e767ed7aa95f3b7f1b61cf63909f5f556ac9c82278ad43db0d15f09a6d36942fdd4100aa3f34ee28ff77e05216770295dca0a6eb60aeb98935fc7af6df76ff5215c19c10361fb99ee4b3a3f38acd749e26256152d9cad7ab95bccadca1916941987b23c4ee9e56325a973c0afd1fd7f92e3cfe5f32f4b16144e6b88d6ad1977e7367d7545c0f3b4202045bf2eef2f6c3df29d3d3ed10e20f0b2d5695421220eafc9b270261aec292f5edc0f7a8aea41be384ff81aff8c44f07cb75b0549c316ed300c80d34cb269b043843f3e39d5ad4aa8d27825fd1ea49fc4415889c71446b33389b042aa59be1fc85ec0b4748f36a37054d54c518787f37366b629ec8802d0a853f520025a25e410b4a5014fb9ee3fd83b839722110c3909c73c78a09d8919c04da7ca27c2083766b2b38f97f0a41822e6ad881055defbac2c9a8aa1b46b598a39fd5d40ff921b956115914fd34db7d8d781a27dfc69df20555b5f80b25d8d7d8e01afa1180b7f65272d149a5f0d80d6a22798a6c6fbeac2c817505fd32d40c7e5a04c56abc78fe9c004364c00920edba0a59dab84e6b44df825660fc843315ab9d184cb46fc7dbf87c4e1e332d9e608f0849e160195e0edbc31ffef22543754df8905e5768fcb0cb190e5f047fab6c41044e74f5b1070bf1b0d4a8cb94f92e270eee0962e980206c07da947b41474f004089e65a95946282cceccc0a92a3ac45f37dcc93f51d04f669049a06d98340834d19042855aadff35bd47de85fea05a17ab1edc312eb40400645e8e12906e4de1a27adcb28a57db5281e48a02441b7cb1dfcee0fd8d5f868942baedbc1f83dfebc8ada3ab643f18b326f09f56e2c336af81169634ed1ffc178f655475090a2a00b68b83dec9ddde6ecd017edddde191e1461ae78856f369c7ea7fc08830f84a369cab38ef3f2657992efca64222ee289ca30698457232ee8c30d13d58aaa5876fe66d3146ff584a6c51ddf8784c6099453e6e847a263e54ae6c03fd6fb4380639d2b850fb8bde3794883dfe672e30343a5505db047c31b57e4afd79f9f7423020aec0efb61e4ad76f149fcb5564de26602b228b8fd9b82238a658b70268628abd7936690e2fce88ab6bda0cb75bc94188081d42ac369d313e73f71d8bd0a773d23ca93d81d1f2f65d8a2b72d5c5c4f8fe244dd49ad253b69c07f673c0a6b56f51fd315568f001c63cb22f43ef8cc8d6d50ccb07c89075f4beb575aa8e95bbfeb946a428a36ef6e7388f2f03de8fc958d2cade4e8c16308f92fe65f122f580c83e69566fc683022003528b332be2bb324894dcabca0ad4886c2b7dcff3f9fac5a93e2103012493874aecb1849be62834891f87863cc6647f7881ec3d05f82203c1dee4347f65e8076cfecbd62baf7b1da7862964178b759f3bcbd53e91750ad1d9d70189c1b8c929dae459c5bc2a51fb01a47a06ec34ded19c50f8d2a53c6dceabff41242070c7745437967b0b39bc4213c25eadf9da3c8019905b21076d20d985705778521cf5b93f8800b06d1db31761b3d2d7d583d7b37407d1e08749b5c8009c8af72de1fb7f8468c79f9efb6b15a72ec770a73940675786539ddc2395fda8654e5062758faab10693fba92eefd2aad723d6565773f74c961e42934dddabfb4da790d9e4f18310768867363d7231a80c4953fd250a8b62be3f4853afc2a7faf537870f0a2388af5ccad3b2b62faa47c0d555f02120aa16af41278da51128ea14a2665019a5d34c79ffca9ae789034adbc56c8a73ceb0f1ebbf540723fab2ba52bf18a33ee20ecd38721860809da674e07046fcf3a7565aac21b27062b2c1e26ed6c006447e4b237948701e05d6b30d1983bc4b5fc575e05734052f4440f615cc135a38d811d008578fc35037a25b2f8b4b5bf483d174043d02faa8af4ed3c522a289f61f5b46c713d22645657015f323281ad0e6043326dd1fc9070185288edd97d5a076c2ecd331930af8a5651d05c5a7fa8700a7ce1ea8241ecc50a1c20f5315a4a7494ed0817808f3075745dbcf492142632c9a8d8a06ea490eecadc32fd962b244feec473e92012fd51b8697b3c5fdff1785fee23e240658696db5e9f1ece878c4e609593946b320b657fee3f3c8632e7c80a937d2b16a22c01bafc86da04b8bf08d93d2027d1feb37c355434696fd892378c74e3a4b0866125b4647e595e3716b8f7bf1430b31bc9999963be069f513876bc3f6cc10b74e6941089791f14e032133663174ab2e5fb4ab61e77c3e302ae5ad774d9cde9520395a087b3230150c14beadac595e03bf24faaa4f783f298ebdd4f1f797c0e57763b2341c143547488b975a586abc582b03c44398ebed8a91b0dcf6db7c2e529a78197feb8d5c3efa167cb9e7561f59913c7f670375e22bea287efcc2d752588f3dbd20467859404f235eab1ff551a68844790154f1f64a09eb846643cd912fdd536a182efd02165f75a730b0e8d120af8759405fc114c23ed038de55ef5888466d9403fa309b593c126e04baae5b19a160324c58d5b7f448b1fa19f69042c5729af96a4f397d1e0d94470176ab051fba1d42058d07baebd3938c3a91a18432be62aac2805083d0452d2c3f0f70ccda5236f2455273565ed876f0e4581c34003683af5d1b3a3c57d369c7bc44850ef6f5a0d7007d5ca2771200bb1407587b117321d7bb8cbe4e0030d23c1f1571e030037d3a65413598f192a7500d3bb09fc1886f43ba5864fe47c369c1adff320bf2a2d11a74af76d8b8327de8f0be24591901408a532c26186b210a83c4c4d6aa799ef5add3146aa07310352791d1fc151bad89c9a28f3289ccea80ad713974609c2883b8871ef4a5fd9d5f1d754e580cf0ecff281b4fb3d6b969881e085fcdf84b909eb370d24351ddbd68adfb8ec199a4278d0ef57c31376939469d41578891729a8e20911e15367c369392293f9bb25d8828d22bf679ef33b0ba9ce574d854a4e916618db649b3b24dc6d66311c1daef9a6de6bbb2f3bee14f6509c2e7d53c1f37fad8f2a4b238c57a4c3015f68f8d750850e61ee6133f14e2a17bac58138938aa0cb8139cf6b361879b9633ec25282e9a4586d1f633839b13c60e8181e7dfff7634d12b379795292c71e00f49ddc82c2bfdda96a7df8be5cdf12b95491c28183efcebdacc6c4fa729f5fb7b5c84bb22dd502ac9e749b1e9fea78f7ffc8e55411f72cd628d7dbd1a7cc67689ed68c7fa144103a3157b329f13191904cc6db29e2d6c672c9132dec1e1e784e0e0b22688884dbff9e82c83a1001b13ccf1e06722e9a18f62e6727b4154beade00fe9b76fc504a74f8e212b96f2ddc3421211bb61e5e16931ed0b3c2e03e898f1d4cc619b127e195bbe51a3efc4bbca90126cda7c4fccba3e9069e80692497fff522a9aaeb93064282b21d0455ac14da7c0fbae48924a567425a0fe13a76edc0d4edc46489a54cf39631fc7f98eb3daa6a3b8ff7b648d8ad9444d915c1204ab669eb6e715822592ed6673ee6992f32d259458d4becc02fd57f249569de6880632edc42d9b3a15b877981a6d807a661511ec3cb5bfa017b66cff803b44914fb4cb309c4fdeb1632c26c78bc480843e7376bcf95a6acc2fb6b21aee33641dfc0ad8292586b4deb7c09452a99effcb65ac49b68b2bc47d3620d36389a094d628ade5c907fb15abb3441f95703f66c1022fe6556f85dff37e8cc543341ec8f50f53129b1f01a8610efcb9e5c4c5a5b721f1f8bfcc17f139c5eeec9f102e605872b75851ab1102095dc23670c7d2224d308bd688e49c353ddac2833e619e06d9edeb8d427259377164764dee15d3afce445350e6a281305ffce2858217d214bf6517ec677ea79ae84a483ccd022fe0c21bc7923bdad51e0f5b17369f9e3969b5c30924b522cddc0fb221e36a325e383f62355e4677fcd8a8f228546e4c7cf41b109a0136156a4f0426e9ad9f821c4f0b9fd036b20f9bc612838e63bd5db4f1f2654dbc5484268567a7c55d91a5d40156489154f5513ec5b0ca928c00a251c7f5c7e008cd72ae0815a8ff081d15729f3b66a8aa731f491b877916d19c528bbc2c388b1d4f1d6a9a21f621a24075d332e20febc385a68d3c01d2aae555a03ff8bfd61823b12f7b6c3fa939b9cdfaa498c0a9a9ec0927e0fa119ac03f54613ae42a51a569f790e49c30fe9efdd43e18da9663592a44d7986735281c473d94ae7858a1d6260797d08af52a5942faf767a389d8a6b509c12a411b19bcd6898f4f7484435770e4932b036aca20636b5f2765264684694606a71b70843b8cc0972d772c8c7435450ba8f6b63eba3690cfdc8f002dfa31df2e54b6066fed99241eeca470f4d7acc647e51f8ae2152842f28864ffb8a7e843ba895c7a7f1922ed79da68412ba76e22cb2e0bd8cd4483314f20cb14fe89595a03eef031d846c3fdfa7eb49fdd5d60d30ffa9fae4817a98737c9d7a83c9074daf02eece73d4506019ce6d65d8d3889c3510c3985b85ed6a9d3d660cb2260b9b78758295109b135ce79ade8b75619e952ca2a0fe1670a461f47dfc6aa6d85c332ed9f37afcb1d9fa6364c15947b281ecffbf8895ff4f5343877599c64f7b105865f0988e347d56a45045529d9f99f79d756f2b618a3fe580bc66a11f8c2a5f577bd801690ac3d7a9bdcc49db3155c5819144afa6c5626bdbc1f9410fcaea346490570c0e21ebc62d1791a24cbcd302912a14a1b494249c2b7347904db109310157c0aee443f04e20451a5a9486aeb0521831dbfbac1f716fb956c03bdaf7723623edbc80c0fe2afd236760978b381a5a865a3bf27e3e7e28a107d0d185d3b00", "74485c02cc3d2feede8f343ae164753039c041dc8e83cbb16678625e308951b919ec42532b0ddebf7bd568e938d258f3ee00d3c529fa5056f3c4ba54a8a4a57e03b62d308475e0403e0169eae259f614fdb3572e19dacebbff87a37f3fadc45c37fa5c0ada4ad4777018737d1a633402cb48311c00a365ea9d15d383e5a9a1b8510350d8e353ba46ab94629d2c9d865b5ab0142faa11b9b3b75a010c3fa12fb17b7f22889d64516b98ecb1d3d5abdd1a9065ea3c61b75a381ca3fc72833aeb3ce266350618d35206a9fd47328077a3407f75b965a36f422cb7ccf0cdd3320bc89f8d43f54db8ad280d988f31e4bd2e0b349207c746737eaec5763673e460d3fc1ca92e147c0c0076b5ee01ef09015936e5ff2a722b0f30b853de48db22251fff8db43f5aff7cfda61aa8a30acc52547fc4f1ba86d65c5cff8a8fd4f14292d647e41fd91a8926f5ce0a92a217b47cb4a01eb1fe44da0badaa18e63df95ebd492401e4f19c351a77b4915d14dc0903ffd196bdb3bae0841dabd83c3bd336d2eb8d2b1d52e351cf1d13d2556bec6c3773cbc8326a5b1e029a9a0d5501e8615e8a2693097c32cf504806c94bd6292a0e9c273bdb7418bcd6dcab07fde463d85b0ae7a273adbfa7a6bcaf62f59d9ceb5b90ddf2fa09335e2499bc18a1c0ec28f83424571022f6e03e4b06c96ae14d25ed4655c30be46ab30ad742380a4733782ec29fcb17b0c42a18ec98d39143679cf6021e1866eb78d734417a7a90fe94ff1f7d63252a3f2f552f61d5629c4834e144a83dbf47753770fa1169a9d7581b2d2f913048d1019c35a993d20803435696eaf879060c03c1fc133773db22f0dd29064129e87bb4cb810afa8b3a4c211f5ed4ee82e542c1802001ccdd2cf4bb44655bbc18bdd810dec8bf439880402573a58ec5d98dffe37bdda12610d78ca9149111b67682f563efd0ff43d99c763fe441577287d9ea38950d9c0c488d6ccb15d7ef6bd42298e54f62914e4cc37a7affc60d5ed630d490ae630d905ac5357882458d13e1e143d3ed86196a45507a3fec8aaf538ed46c3fcc0899f20361cb7620ee559fc2d5e59381cf0475702eeadd1cde56495304b553127c8450083cd003c6a28833e5844d6c044b293bea77c2c37f0ba360fdd9df8fe29e975c18a152691b66ec0c48ca023dc2ef1e231f0239093dd85c3ac5c25099480fb45759483f7627b76ae71422352180cefd8aec61dd11fade823d272813eddfdab2c34d69822844457ed47b37249cc1fc1da7e786d0fe8897bada810a775fe63b24becd28553267057cd5a9f967196ca2d26f31a379a45e9046b1d52880393efa7daa5bbfd9709ea28b7c736cca866db084519da5a249d418d6c00291c6d37f3c2688ff4db0d1b29a8af482b7e17d802063b03122e4bab958db144c9ef2ef21b4789a5263a14a15d5e698509f0e1d51a0bb4e37f4a12f8a7dda9e4afe5058abaf7d6d134db578e93debc6b275fbb83833b3fed96def21326626df8e81ca29e5e6538c38afec7740c7b80dfbd57021ea9e268383a08f09ac42cf53ae6df0cdc6605c29496c816b9bfb06dd7314c360fc4d2bea8ca6121eb989ff7a0eaef8b40f77057d5f7111195ce663516842430f3b8725eab2b60988eebb93c2ac5b0cbc0e8751bedeeb2cb728ea23530b14948fcef6c6d16bacc952fdf5dcb5fc281680d9464b549357cd65d26f9a50dd4bbb48f509e4a8e1f9ce73900e61b52e4aa66f7d627e9261e7ae30d5ee7edaa1b31b851718bd66ad72f33f968b2889d7fd9583a490f8f05a45b4f67030dad0773b6ff133fa50eeda36a4f8bd9caed0d0e6acac29992e28194ccb909b5f9f72839960e2a6f773f7e71214c3d6c06dc05660d9084993f8e9775cb27c3514476ab27b07e4942a36cecc24399bcacf9b254dc8de0a14edfff1faa48ee4a86f17b5e7303cf543378f4606664bd7b4ee00bb31869047b1048afbee53489b529e0d4de612f922f0faefc741df7db47a59bf42e14be1db6c54297853cd1cf694368696006f4a2bdf2d8a8ac71bc389f2eead73ec542449e7283f05479363343a121811d67df6130ac6a728668d354fa3fa98ad3ebd266e0c427366d0253e4c470b458551ef46c41764e84f90ea7f680a57f8f63988ee3f44e541139915786f1440858fa343a068f3d5337295b8d6faa846595b0ab536ed9b8eba2a5e79d83074300979573e9630fdc73fd071ee65a1519df075c5496de01ecc80724598e3c65e60b4f07738de5928ad43290c5c166cd510299408a46b29980cc488316d6f4e70b167ecc45ce62faacf3c37e59bd31961830d62b33888e7a4c0a4a294bcde3515a0b4b3312c3ec97a64036368de747b01787e9cceb13bdf08438627772d56be7b3267bb18516ccb7992d8ac18e2d7c93964893403f13c118b3c56d4f749875e85f8cb2188afb420961313cbac5ab21dbd3a8d26bfcf32068b1044079a77a79135064b00f081cd62f5312c251ddaad2c08dacef1e15eab544c6823c73abda1a7532eaa040ace18bd360bb6acbf62677665f1f681b8bac479ae3e29c7c9621ea96a439636a7c6fe2bf67f369b232dec683ed6e638c4fead14927c59a1b8201e3b90cf789128e1cf85f9db332ee539d77a5286ea8bed0cbc82ea219e9d6fc052879cb0e1a0cf78969e24e8fa9fbfd6652deb1f8237d3700810c9d8f85684b12c6f7801f591fc141a2fdf18b88bb4a97fb4f582600b130a34885c734e7abf1b5aaa9049e23118d696cf093f11524cb1c9218d1758b584f65b81b97983d350a6c67f395119716540e67f481b825d3a43213c4d86b4fca718f76625200f011ff5f504bbcb877439b9f222007ad885e6172b21ebf5482d4bd15c39b71fa980f339d141638e71ce602c898b82d6f3ebe2fe46939501a297582f1800e57610fd402297a2887d02cdffafcecf4055668f55ffb2c1a303f0d5f4cd340a6e6ae607c1627a3474835c38270ac2c4787bcbea8b3789299288c5b21a1720146a3aefcc435ea9ecbad7168ecf8e74af571e94335646bbfacdf60bec560565322ddf1359189706da5df598d97569a006d708a96a45e9537d0d6876bbdb69f438fb5f8bfe249870dd15a973d844f2645d36a09c5ad6d68830bab9ddebd683ff2edccec842bfbcff3ad3f4041c116a250650f6b1696f24c0280246b3cda9ee278b40edbd1719187836dc0139e528e6e271ca288477e09371f67c3a6755257498fb6587a24fb33cd6a75453b1ecc374c09d3d15c8d8aaeb356a5dcb8c61232b460d4faf13f842bd57f23f54dc15a3c29c31b659df855c0006fd91e7c7ef04e157c1302a3c9b8f03e26e8f820f42753d96d35f0e2c9b4205a72ddfdc583d8cd08132d5571f20e7ae2fabd40eddb159cf48930823ee81e55d9574ef263d642cb3b355315cb2647b3786050044b0442d5dd7227d338231aa618a6425e34d86fa9e9cabefed142f8d7038fb12c264ff3461e500744e7ed43e0c1b285d24e09c5aac636c222417d76e871825e9eb59552cd78c1a7beede494c351a9b933829f8d8afe1c31d07a3f87972c199cd6db93d0d4df05d6f3ee418a244933b3d013f5f6b7f2bbc44a23a77daef007c5e63beac083557da3957504e631c68294a3c5bc05e28b4a61d86304b36e52e56a6aa51405eca433d7374d022fa61b34df6fb1f648adc7c8e54b6d4b70b4218321e7cdd101c50b2b3fbe749e51b833db3b0f2108011d66a205fe2e520872404edc075defbd4e5ff9932bacd2f1e28d0c64d5d8ce07e587e1662487855103b5c473593292e392181e8609fc6986b3c99013a75c80c7c55689ae7f6ae4d1b3699138eb76b123814b6bdbf592803fcd0cfe1e7cd9a7a8d04ef5ab0cc6c12079452d6232b1aec88b1b2c99f50032b30861f1f0047e0f22fa2412d2052f788b3921f6e19a1a09fb4b319d6fc19662ef69d0b3176e2162d16513f55baa5df8173791a1b6bf8bb1c4a41032beb217102b999ab00b73158c2c91aa07ce08a4d01b7d24128514d830e8d0717dc315d73ee624ffda68d83ac8b2686b126af3e9d549adbf52443733587baaf511589b93e7606be7fefd973cf8e719b08508ac67715a77e4e40be56dfd4f5d173a73527bb900bbc8f61b94cd601261af24e4945b30fed761a101b2a732fa21a8a347041ced5551738ed2ffd822e1090e3b1129c3a569c4eaa298349b73d4a1329c8a91492f053c26378f0e7f5f8e2ba478b14de7a0fb22b7ca3f0c57ef34ad597f77d9e4d52709d0942fd618f47a03c07e32551b47f62b78c2063b08b0e4f06c5bf61a384a2e93df6445166279b3e515e08c41148f49f2e981df4dbe24b8efb52b3a3397a1d8d8ea277404c9516c9aeae255003f8df8ad2bf95eb1087859a55341b6bbfd39a37d26ed5607b465cbe6fcb34e3d456ec6023e8cb1347c1b9d816e32064945740982d16332683d2a106e66c96b7c4301865073bde539820d8c3c87542a7db15da3210a8997d1a163dfda978902e6572f1753913350b0b8d34cc6a5866c31968ae71a0c3110b3b8efd0c1ea9deeb44f9d9176e49576a0c0e9f7ec344de985c8256dad9025b1c94cac913b43388aa8e34191557b024edcfe2c9dde1547946e20e993782f2ca007ca5fc4cc9ecfa40f5f35e8ecde53fd62790c86921246783ebea20bbfcb8c6952bbd0863b7a0acb510f19fd8835184fcbd795fb0f50e1e61ec1544c56e1080eb8e566f507d550380104c82b1e064c6a25b391dc77c774e76532e2866a9f2bfdccc03b627db83556e6247872c56408876011afa0fd746c84d49034d896b555fae2a74d70b176b9ec64416cab9b249822be2a01de20a1157b729c7eab21107f20fab5be9f2644556cdf4ddcdad7438f9e60129a4451486a9eea253d54072e0a0b8b796b3bb7d9008a4616d028966c5078540c248ad5e3433982abb0097975d23ca3a9a7f3a8713cfa4107129d5281ac0b1fc68bf9a865c69b0651e40d6a4b96a71c3d009e4cf309dbffaf2fb0f52920ef473ac4717d7fe5d3b0eca4976c6bb153c5855a1594cd23704be42876e66253c104d69081c8d7f49c0480144623bfb426cf1b55c1af78023fcdcfcc76f411101456982a045e774d3a1ce63bc208374431032a3d95ace5f9d9f2ad390e0f3ca557068db53bcec9ae5f8f20531c5229a92ee9d9d594b6edf0ada953ea27b2289493a907602d25ecb0fd74161a4585b2a89cec0f869cc9130615aaf0952bd71a6f3039731f53f277fb016a18e14a01b4999742c5de7141148697e448fb4f9293ef4e87a716fca9f9ef59cfca10630a099ec8a58e1c92e19f4ecf8c9422107d375b0bbea135e48b0c9baaabaeba4397dc198dac83a656912178bce22569379e9dac575fef89d743d36f4b627a9639cd3649e498270b966c0b5eaa235e7e2b8bf1d26214af7d3649e2a6b9386151c6170c142d0db167cbd4f152ad8f561169c135fe8114fba923e6e70c7060a75344a620b127eea66ce6932e2b4c9952cf18a05faf989b8fa0cfa7e36e3898a4a8e8c98ba5f812e713f0a5d9850f5e991ddb417a7974f68fd4d4e5a8c41f7f0d903108ca374d79000c67f28614c2023c31284bd22cde507dec0e643dfa6b588d870fcaf3182c0064d58d1c27ced135e28ba6ae0a3c09b8f276dbf5bda96b3819218204e88ec1e5c517d87353d6539b3c75bb97922c5ce2b75c4d34070ab15bfb4f4320fc5855c16d405c28d0797af878798187277a899036d7f79efbc062d22f897065989937d0cb1b31b00"}}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48e, 0x0, 0x40}]}) executing program 9: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_ACT={0x30, 0x3, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) executing program 9: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) getsockopt(r2, 0x111, 0x4, 0x0, &(0x7f0000000080)) executing program 9: pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0) tee(r0, r4, 0xf3a, 0x4) write$binfmt_elf64(r2, &(0x7f0000000380)=ANY=[], 0x18c6) executing program 9: r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000040)=ANY=[]) executing program 4: r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0x1, 0xb}, {0x7, 0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000200)=0x9) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000500)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200c8084, &(0x7f0000000080)={0xa, 0x4e28, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) executing program 3: r0 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xc3) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xe6) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xffffffffffffffff) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd2b, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xffe0, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x7fff, 0x7, 0x7, 0xff07}, {{0x2, 0x1}, {0x4, 0x1}}}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x24000000) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000180640fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e224e22", @ANYRES32=0x0, @ANYRES32=0x41424344, @ANYBLOB="601810"], 0x0) executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000001007b"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000000)=0x3, 0x4) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=""/23, 0x17}, 0x80009}], 0x16c, 0x10002, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r2, 0x61646, 0x3020}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x480) executing program 3: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x8820) executing program 4: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1b}}, 0x20) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000040), 0x4) read(r0, &(0x7f0000000080)=""/135, 0x87) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00100000000000000000000c000f"], 0x6c}, 0x1, 0x0, 0x0, 0x40811}, 0x20) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)={0xe5, 0x0, [{0x80000001, 0x2, 0x4, 0x8001}]}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r3, 0xffffffffffffffff, 0x0) program crashed: KASAN: slab-out-of-bounds Write in try_module_get bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 9: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10) sendto(r0, &(0x7f0000000340)="1735", 0x2, 0x240148c1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001d40)=""/4096, 0x1000}], 0x1}, 0x1}], 0x1, 0x10022, 0x0) executing program 9: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x5, 0x8, 0xffffffff, 0x7}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000006000)=@vmx={0x0, 0x0, 0x2080, {0x54000, 0x8080000, {}, 0x1, 0x6}, {"cfe274ab958596a18f48df8c02940a5f500fb5b3c7c98a8f1bab36eedb7479373c8e69e784da80d6f072c0e004dc9b1e1e55341fbc56e170067b1cc38d2b253298bd202f2e123d5648d7c52fe8d4ae4f2658e7fade39ca34735a5dda720272b7dd244c887ef38ab2e1f76903c3e17a5b9a4a39b439833517e44fdafb5ec17fcee283ce983ad4332b583a1261cc30690a4f91f8676865ed446d6fdef42a9e0407d0dbe32716b6743e01bc02527c0e0afa7ad94f4cf53f4b9d4be36ca2d48f8ceafedd9f65898c3811c23eb05666241ebd78b7a476b5a6aebf38780257e5d150c1c88433569aff06305d5306161adf35899e4bd72b1c84c602b16eff131f30a06c20da4747ce17482d42fc241a3133d01463215de68c845f90a6998e9129f22f4140a47d225585ac94000f1cc8a55f3b381cdd71bd57652f063be52b4dd6679fb43d3a6fbf74abdf79ab07a8e289dee138c9c504bf787b188217111f81679394236aa10b47003834f9b5e05486f11d3ad525119c7d6c6290181c351b857f4cfa302d6ef2ee89f5a68201014de2e1dbddc1b67b67e17a9a6d4531092120470686449a2cab9a737c5e04accb6067d046f7ecbd1b745b58dd15879c1ea48faf012fc03501d167637c7b78d47299ae76537996f36a272766c3f2ff2cd7dfa6e0d813c41cc633478d74ee5dced5ee788f11b7d75926d22eefe7a8b6be5d55ef759769f595a6390cca7702871c34d889eafd379fd6df37677c0f5e060ed8890b4e8079e598c71c687130795d66fc3c50bded002e3cd07fed23fe008809646f0b0b349a0420eee2077dedca495cf22a9376811032388c7e9a218200881a2408a2dc3644b11b3e709a450e1da7caf79d221671f2e4332054d3118bc84fa4ebcf30fa6a5477638ef92158ec38808bdc1520621b6b1885618eaf456b65adfd1ec5db0d070e767ed7aa95f3b7f1b61cf63909f5f556ac9c82278ad43db0d15f09a6d36942fdd4100aa3f34ee28ff77e05216770295dca0a6eb60aeb98935fc7af6df76ff5215c19c10361fb99ee4b3a3f38acd749e26256152d9cad7ab95bccadca1916941987b23c4ee9e56325a973c0afd1fd7f92e3cfe5f32f4b16144e6b88d6ad1977e7367d7545c0f3b4202045bf2eef2f6c3df29d3d3ed10e20f0b2d5695421220eafc9b270261aec292f5edc0f7a8aea41be384ff81aff8c44f07cb75b0549c316ed300c80d34cb269b043843f3e39d5ad4aa8d27825fd1ea49fc4415889c71446b33389b042aa59be1fc85ec0b4748f36a37054d54c518787f37366b629ec8802d0a853f520025a25e410b4a5014fb9ee3fd83b839722110c3909c73c78a09d8919c04da7ca27c2083766b2b38f97f0a41822e6ad881055defbac2c9a8aa1b46b598a39fd5d40ff921b956115914fd34db7d8d781a27dfc69df20555b5f80b25d8d7d8e01afa1180b7f65272d149a5f0d80d6a22798a6c6fbeac2c817505fd32d40c7e5a04c56abc78fe9c004364c00920edba0a59dab84e6b44df825660fc843315ab9d184cb46fc7dbf87c4e1e332d9e608f0849e160195e0edbc31ffef22543754df8905e5768fcb0cb190e5f047fab6c41044e74f5b1070bf1b0d4a8cb94f92e270eee0962e980206c07da947b41474f004089e65a95946282cceccc0a92a3ac45f37dcc93f51d04f669049a06d98340834d19042855aadff35bd47de85fea05a17ab1edc312eb40400645e8e12906e4de1a27adcb28a57db5281e48a02441b7cb1dfcee0fd8d5f868942baedbc1f83dfebc8ada3ab643f18b326f09f56e2c336af81169634ed1ffc178f655475090a2a00b68b83dec9ddde6ecd017edddde191e1461ae78856f369c7ea7fc08830f84a369cab38ef3f2657992efca64222ee289ca30698457232ee8c30d13d58aaa5876fe66d3146ff584a6c51ddf8784c6099453e6e847a263e54ae6c03fd6fb4380639d2b850fb8bde3794883dfe672e30343a5505db047c31b57e4afd79f9f7423020aec0efb61e4ad76f149fcb5564de26602b228b8fd9b82238a658b70268628abd7936690e2fce88ab6bda0cb75bc94188081d42ac369d313e73f71d8bd0a773d23ca93d81d1f2f65d8a2b72d5c5c4f8fe244dd49ad253b69c07f673c0a6b56f51fd315568f001c63cb22f43ef8cc8d6d50ccb07c89075f4beb575aa8e95bbfeb946a428a36ef6e7388f2f03de8fc958d2cade4e8c16308f92fe65f122f580c83e69566fc683022003528b332be2bb324894dcabca0ad4886c2b7dcff3f9fac5a93e2103012493874aecb1849be62834891f87863cc6647f7881ec3d05f82203c1dee4347f65e8076cfecbd62baf7b1da7862964178b759f3bcbd53e91750ad1d9d70189c1b8c929dae459c5bc2a51fb01a47a06ec34ded19c50f8d2a53c6dceabff41242070c7745437967b0b39bc4213c25eadf9da3c8019905b21076d20d985705778521cf5b93f8800b06d1db31761b3d2d7d583d7b37407d1e08749b5c8009c8af72de1fb7f8468c79f9efb6b15a72ec770a73940675786539ddc2395fda8654e5062758faab10693fba92eefd2aad723d6565773f74c961e42934dddabfb4da790d9e4f18310768867363d7231a80c4953fd250a8b62be3f4853afc2a7faf537870f0a2388af5ccad3b2b62faa47c0d555f02120aa16af41278da51128ea14a2665019a5d34c79ffca9ae789034adbc56c8a73ceb0f1ebbf540723fab2ba52bf18a33ee20ecd38721860809da674e07046fcf3a7565aac21b27062b2c1e26ed6c006447e4b237948701e05d6b30d1983bc4b5fc575e05734052f4440f615cc135a38d811d008578fc35037a25b2f8b4b5bf483d174043d02faa8af4ed3c522a289f61f5b46c713d22645657015f323281ad0e6043326dd1fc9070185288edd97d5a076c2ecd331930af8a5651d05c5a7fa8700a7ce1ea8241ecc50a1c20f5315a4a7494ed0817808f3075745dbcf492142632c9a8d8a06ea490eecadc32fd962b244feec473e92012fd51b8697b3c5fdff1785fee23e240658696db5e9f1ece878c4e609593946b320b657fee3f3c8632e7c80a937d2b16a22c01bafc86da04b8bf08d93d2027d1feb37c355434696fd892378c74e3a4b0866125b4647e595e3716b8f7bf1430b31bc9999963be069f513876bc3f6cc10b74e6941089791f14e032133663174ab2e5fb4ab61e77c3e302ae5ad774d9cde9520395a087b3230150c14beadac595e03bf24faaa4f783f298ebdd4f1f797c0e57763b2341c143547488b975a586abc582b03c44398ebed8a91b0dcf6db7c2e529a78197feb8d5c3efa167cb9e7561f59913c7f670375e22bea287efcc2d752588f3dbd20467859404f235eab1ff551a68844790154f1f64a09eb846643cd912fdd536a182efd02165f75a730b0e8d120af8759405fc114c23ed038de55ef5888466d9403fa309b593c126e04baae5b19a160324c58d5b7f448b1fa19f69042c5729af96a4f397d1e0d94470176ab051fba1d42058d07baebd3938c3a91a18432be62aac2805083d0452d2c3f0f70ccda5236f2455273565ed876f0e4581c34003683af5d1b3a3c57d369c7bc44850ef6f5a0d7007d5ca2771200bb1407587b117321d7bb8cbe4e0030d23c1f1571e030037d3a65413598f192a7500d3bb09fc1886f43ba5864fe47c369c1adff320bf2a2d11a74af76d8b8327de8f0be24591901408a532c26186b210a83c4c4d6aa799ef5add3146aa07310352791d1fc151bad89c9a28f3289ccea80ad713974609c2883b8871ef4a5fd9d5f1d754e580cf0ecff281b4fb3d6b969881e085fcdf84b909eb370d24351ddbd68adfb8ec199a4278d0ef57c31376939469d41578891729a8e20911e15367c369392293f9bb25d8828d22bf679ef33b0ba9ce574d854a4e916618db649b3b24dc6d66311c1daef9a6de6bbb2f3bee14f6509c2e7d53c1f37fad8f2a4b238c57a4c3015f68f8d750850e61ee6133f14e2a17bac58138938aa0cb8139cf6b361879b9633ec25282e9a4586d1f633839b13c60e8181e7dfff7634d12b379795292c71e00f49ddc82c2bfdda96a7df8be5cdf12b95491c28183efcebdacc6c4fa729f5fb7b5c84bb22dd502ac9e749b1e9fea78f7ffc8e55411f72cd628d7dbd1a7cc67689ed68c7fa144103a3157b329f13191904cc6db29e2d6c672c9132dec1e1e784e0e0b22688884dbff9e82c83a1001b13ccf1e06722e9a18f62e6727b4154beade00fe9b76fc504a74f8e212b96f2ddc3421211bb61e5e16931ed0b3c2e03e898f1d4cc619b127e195bbe51a3efc4bbca90126cda7c4fccba3e9069e80692497fff522a9aaeb93064282b21d0455ac14da7c0fbae48924a567425a0fe13a76edc0d4edc46489a54cf39631fc7f98eb3daa6a3b8ff7b648d8ad9444d915c1204ab669eb6e715822592ed6673ee6992f32d259458d4becc02fd57f249569de6880632edc42d9b3a15b877981a6d807a661511ec3cb5bfa017b66cff803b44914fb4cb309c4fdeb1632c26c78bc480843e7376bcf95a6acc2fb6b21aee33641dfc0ad8292586b4deb7c09452a99effcb65ac49b68b2bc47d3620d36389a094d628ade5c907fb15abb3441f95703f66c1022fe6556f85dff37e8cc543341ec8f50f53129b1f01a8610efcb9e5c4c5a5b721f1f8bfcc17f139c5eeec9f102e605872b75851ab1102095dc23670c7d2224d308bd688e49c353ddac2833e619e06d9edeb8d427259377164764dee15d3afce445350e6a281305ffce2858217d214bf6517ec677ea79ae84a483ccd022fe0c21bc7923bdad51e0f5b17369f9e3969b5c30924b522cddc0fb221e36a325e383f62355e4677fcd8a8f228546e4c7cf41b109a0136156a4f0426e9ad9f821c4f0b9fd036b20f9bc612838e63bd5db4f1f2654dbc5484268567a7c55d91a5d40156489154f5513ec5b0ca928c00a251c7f5c7e008cd72ae0815a8ff081d15729f3b66a8aa731f491b877916d19c528bbc2c388b1d4f1d6a9a21f621a24075d332e20febc385a68d3c01d2aae555a03ff8bfd61823b12f7b6c3fa939b9cdfaa498c0a9a9ec0927e0fa119ac03f54613ae42a51a569f790e49c30fe9efdd43e18da9663592a44d7986735281c473d94ae7858a1d6260797d08af52a5942faf767a389d8a6b509c12a411b19bcd6898f4f7484435770e4932b036aca20636b5f2765264684694606a71b70843b8cc0972d772c8c7435450ba8f6b63eba3690cfdc8f002dfa31df2e54b6066fed99241eeca470f4d7acc647e51f8ae2152842f28864ffb8a7e843ba895c7a7f1922ed79da68412ba76e22cb2e0bd8cd4483314f20cb14fe89595a03eef031d846c3fdfa7eb49fdd5d60d30ffa9fae4817a98737c9d7a83c9074daf02eece73d4506019ce6d65d8d3889c3510c3985b85ed6a9d3d660cb2260b9b78758295109b135ce79ade8b75619e952ca2a0fe1670a461f47dfc6aa6d85c332ed9f37afcb1d9fa6364c15947b281ecffbf8895ff4f5343877599c64f7b105865f0988e347d56a45045529d9f99f79d756f2b618a3fe580bc66a11f8c2a5f577bd801690ac3d7a9bdcc49db3155c5819144afa6c5626bdbc1f9410fcaea346490570c0e21ebc62d1791a24cbcd302912a14a1b494249c2b7347904db109310157c0aee443f04e20451a5a9486aeb0521831dbfbac1f716fb956c03bdaf7723623edbc80c0fe2afd236760978b381a5a865a3bf27e3e7e28a107d0d185d3b00", "74485c02cc3d2feede8f343ae164753039c041dc8e83cbb16678625e308951b919ec42532b0ddebf7bd568e938d258f3ee00d3c529fa5056f3c4ba54a8a4a57e03b62d308475e0403e0169eae259f614fdb3572e19dacebbff87a37f3fadc45c37fa5c0ada4ad4777018737d1a633402cb48311c00a365ea9d15d383e5a9a1b8510350d8e353ba46ab94629d2c9d865b5ab0142faa11b9b3b75a010c3fa12fb17b7f22889d64516b98ecb1d3d5abdd1a9065ea3c61b75a381ca3fc72833aeb3ce266350618d35206a9fd47328077a3407f75b965a36f422cb7ccf0cdd3320bc89f8d43f54db8ad280d988f31e4bd2e0b349207c746737eaec5763673e460d3fc1ca92e147c0c0076b5ee01ef09015936e5ff2a722b0f30b853de48db22251fff8db43f5aff7cfda61aa8a30acc52547fc4f1ba86d65c5cff8a8fd4f14292d647e41fd91a8926f5ce0a92a217b47cb4a01eb1fe44da0badaa18e63df95ebd492401e4f19c351a77b4915d14dc0903ffd196bdb3bae0841dabd83c3bd336d2eb8d2b1d52e351cf1d13d2556bec6c3773cbc8326a5b1e029a9a0d5501e8615e8a2693097c32cf504806c94bd6292a0e9c273bdb7418bcd6dcab07fde463d85b0ae7a273adbfa7a6bcaf62f59d9ceb5b90ddf2fa09335e2499bc18a1c0ec28f83424571022f6e03e4b06c96ae14d25ed4655c30be46ab30ad742380a4733782ec29fcb17b0c42a18ec98d39143679cf6021e1866eb78d734417a7a90fe94ff1f7d63252a3f2f552f61d5629c4834e144a83dbf47753770fa1169a9d7581b2d2f913048d1019c35a993d20803435696eaf879060c03c1fc133773db22f0dd29064129e87bb4cb810afa8b3a4c211f5ed4ee82e542c1802001ccdd2cf4bb44655bbc18bdd810dec8bf439880402573a58ec5d98dffe37bdda12610d78ca9149111b67682f563efd0ff43d99c763fe441577287d9ea38950d9c0c488d6ccb15d7ef6bd42298e54f62914e4cc37a7affc60d5ed630d490ae630d905ac5357882458d13e1e143d3ed86196a45507a3fec8aaf538ed46c3fcc0899f20361cb7620ee559fc2d5e59381cf0475702eeadd1cde56495304b553127c8450083cd003c6a28833e5844d6c044b293bea77c2c37f0ba360fdd9df8fe29e975c18a152691b66ec0c48ca023dc2ef1e231f0239093dd85c3ac5c25099480fb45759483f7627b76ae71422352180cefd8aec61dd11fade823d272813eddfdab2c34d69822844457ed47b37249cc1fc1da7e786d0fe8897bada810a775fe63b24becd28553267057cd5a9f967196ca2d26f31a379a45e9046b1d52880393efa7daa5bbfd9709ea28b7c736cca866db084519da5a249d418d6c00291c6d37f3c2688ff4db0d1b29a8af482b7e17d802063b03122e4bab958db144c9ef2ef21b4789a5263a14a15d5e698509f0e1d51a0bb4e37f4a12f8a7dda9e4afe5058abaf7d6d134db578e93debc6b275fbb83833b3fed96def21326626df8e81ca29e5e6538c38afec7740c7b80dfbd57021ea9e268383a08f09ac42cf53ae6df0cdc6605c29496c816b9bfb06dd7314c360fc4d2bea8ca6121eb989ff7a0eaef8b40f77057d5f7111195ce663516842430f3b8725eab2b60988eebb93c2ac5b0cbc0e8751bedeeb2cb728ea23530b14948fcef6c6d16bacc952fdf5dcb5fc281680d9464b549357cd65d26f9a50dd4bbb48f509e4a8e1f9ce73900e61b52e4aa66f7d627e9261e7ae30d5ee7edaa1b31b851718bd66ad72f33f968b2889d7fd9583a490f8f05a45b4f67030dad0773b6ff133fa50eeda36a4f8bd9caed0d0e6acac29992e28194ccb909b5f9f72839960e2a6f773f7e71214c3d6c06dc05660d9084993f8e9775cb27c3514476ab27b07e4942a36cecc24399bcacf9b254dc8de0a14edfff1faa48ee4a86f17b5e7303cf543378f4606664bd7b4ee00bb31869047b1048afbee53489b529e0d4de612f922f0faefc741df7db47a59bf42e14be1db6c54297853cd1cf694368696006f4a2bdf2d8a8ac71bc389f2eead73ec542449e7283f05479363343a121811d67df6130ac6a728668d354fa3fa98ad3ebd266e0c427366d0253e4c470b458551ef46c41764e84f90ea7f680a57f8f63988ee3f44e541139915786f1440858fa343a068f3d5337295b8d6faa846595b0ab536ed9b8eba2a5e79d83074300979573e9630fdc73fd071ee65a1519df075c5496de01ecc80724598e3c65e60b4f07738de5928ad43290c5c166cd510299408a46b29980cc488316d6f4e70b167ecc45ce62faacf3c37e59bd31961830d62b33888e7a4c0a4a294bcde3515a0b4b3312c3ec97a64036368de747b01787e9cceb13bdf08438627772d56be7b3267bb18516ccb7992d8ac18e2d7c93964893403f13c118b3c56d4f749875e85f8cb2188afb420961313cbac5ab21dbd3a8d26bfcf32068b1044079a77a79135064b00f081cd62f5312c251ddaad2c08dacef1e15eab544c6823c73abda1a7532eaa040ace18bd360bb6acbf62677665f1f681b8bac479ae3e29c7c9621ea96a439636a7c6fe2bf67f369b232dec683ed6e638c4fead14927c59a1b8201e3b90cf789128e1cf85f9db332ee539d77a5286ea8bed0cbc82ea219e9d6fc052879cb0e1a0cf78969e24e8fa9fbfd6652deb1f8237d3700810c9d8f85684b12c6f7801f591fc141a2fdf18b88bb4a97fb4f582600b130a34885c734e7abf1b5aaa9049e23118d696cf093f11524cb1c9218d1758b584f65b81b97983d350a6c67f395119716540e67f481b825d3a43213c4d86b4fca718f76625200f011ff5f504bbcb877439b9f222007ad885e6172b21ebf5482d4bd15c39b71fa980f339d141638e71ce602c898b82d6f3ebe2fe46939501a297582f1800e57610fd402297a2887d02cdffafcecf4055668f55ffb2c1a303f0d5f4cd340a6e6ae607c1627a3474835c38270ac2c4787bcbea8b3789299288c5b21a1720146a3aefcc435ea9ecbad7168ecf8e74af571e94335646bbfacdf60bec560565322ddf1359189706da5df598d97569a006d708a96a45e9537d0d6876bbdb69f438fb5f8bfe249870dd15a973d844f2645d36a09c5ad6d68830bab9ddebd683ff2edccec842bfbcff3ad3f4041c116a250650f6b1696f24c0280246b3cda9ee278b40edbd1719187836dc0139e528e6e271ca288477e09371f67c3a6755257498fb6587a24fb33cd6a75453b1ecc374c09d3d15c8d8aaeb356a5dcb8c61232b460d4faf13f842bd57f23f54dc15a3c29c31b659df855c0006fd91e7c7ef04e157c1302a3c9b8f03e26e8f820f42753d96d35f0e2c9b4205a72ddfdc583d8cd08132d5571f20e7ae2fabd40eddb159cf48930823ee81e55d9574ef263d642cb3b355315cb2647b3786050044b0442d5dd7227d338231aa618a6425e34d86fa9e9cabefed142f8d7038fb12c264ff3461e500744e7ed43e0c1b285d24e09c5aac636c222417d76e871825e9eb59552cd78c1a7beede494c351a9b933829f8d8afe1c31d07a3f87972c199cd6db93d0d4df05d6f3ee418a244933b3d013f5f6b7f2bbc44a23a77daef007c5e63beac083557da3957504e631c68294a3c5bc05e28b4a61d86304b36e52e56a6aa51405eca433d7374d022fa61b34df6fb1f648adc7c8e54b6d4b70b4218321e7cdd101c50b2b3fbe749e51b833db3b0f2108011d66a205fe2e520872404edc075defbd4e5ff9932bacd2f1e28d0c64d5d8ce07e587e1662487855103b5c473593292e392181e8609fc6986b3c99013a75c80c7c55689ae7f6ae4d1b3699138eb76b123814b6bdbf592803fcd0cfe1e7cd9a7a8d04ef5ab0cc6c12079452d6232b1aec88b1b2c99f50032b30861f1f0047e0f22fa2412d2052f788b3921f6e19a1a09fb4b319d6fc19662ef69d0b3176e2162d16513f55baa5df8173791a1b6bf8bb1c4a41032beb217102b999ab00b73158c2c91aa07ce08a4d01b7d24128514d830e8d0717dc315d73ee624ffda68d83ac8b2686b126af3e9d549adbf52443733587baaf511589b93e7606be7fefd973cf8e719b08508ac67715a77e4e40be56dfd4f5d173a73527bb900bbc8f61b94cd601261af24e4945b30fed761a101b2a732fa21a8a347041ced5551738ed2ffd822e1090e3b1129c3a569c4eaa298349b73d4a1329c8a91492f053c26378f0e7f5f8e2ba478b14de7a0fb22b7ca3f0c57ef34ad597f77d9e4d52709d0942fd618f47a03c07e32551b47f62b78c2063b08b0e4f06c5bf61a384a2e93df6445166279b3e515e08c41148f49f2e981df4dbe24b8efb52b3a3397a1d8d8ea277404c9516c9aeae255003f8df8ad2bf95eb1087859a55341b6bbfd39a37d26ed5607b465cbe6fcb34e3d456ec6023e8cb1347c1b9d816e32064945740982d16332683d2a106e66c96b7c4301865073bde539820d8c3c87542a7db15da3210a8997d1a163dfda978902e6572f1753913350b0b8d34cc6a5866c31968ae71a0c3110b3b8efd0c1ea9deeb44f9d9176e49576a0c0e9f7ec344de985c8256dad9025b1c94cac913b43388aa8e34191557b024edcfe2c9dde1547946e20e993782f2ca007ca5fc4cc9ecfa40f5f35e8ecde53fd62790c86921246783ebea20bbfcb8c6952bbd0863b7a0acb510f19fd8835184fcbd795fb0f50e1e61ec1544c56e1080eb8e566f507d550380104c82b1e064c6a25b391dc77c774e76532e2866a9f2bfdccc03b627db83556e6247872c56408876011afa0fd746c84d49034d896b555fae2a74d70b176b9ec64416cab9b249822be2a01de20a1157b729c7eab21107f20fab5be9f2644556cdf4ddcdad7438f9e60129a4451486a9eea253d54072e0a0b8b796b3bb7d9008a4616d028966c5078540c248ad5e3433982abb0097975d23ca3a9a7f3a8713cfa4107129d5281ac0b1fc68bf9a865c69b0651e40d6a4b96a71c3d009e4cf309dbffaf2fb0f52920ef473ac4717d7fe5d3b0eca4976c6bb153c5855a1594cd23704be42876e66253c104d69081c8d7f49c0480144623bfb426cf1b55c1af78023fcdcfcc76f411101456982a045e774d3a1ce63bc208374431032a3d95ace5f9d9f2ad390e0f3ca557068db53bcec9ae5f8f20531c5229a92ee9d9d594b6edf0ada953ea27b2289493a907602d25ecb0fd74161a4585b2a89cec0f869cc9130615aaf0952bd71a6f3039731f53f277fb016a18e14a01b4999742c5de7141148697e448fb4f9293ef4e87a716fca9f9ef59cfca10630a099ec8a58e1c92e19f4ecf8c9422107d375b0bbea135e48b0c9baaabaeba4397dc198dac83a656912178bce22569379e9dac575fef89d743d36f4b627a9639cd3649e498270b966c0b5eaa235e7e2b8bf1d26214af7d3649e2a6b9386151c6170c142d0db167cbd4f152ad8f561169c135fe8114fba923e6e70c7060a75344a620b127eea66ce6932e2b4c9952cf18a05faf989b8fa0cfa7e36e3898a4a8e8c98ba5f812e713f0a5d9850f5e991ddb417a7974f68fd4d4e5a8c41f7f0d903108ca374d79000c67f28614c2023c31284bd22cde507dec0e643dfa6b588d870fcaf3182c0064d58d1c27ced135e28ba6ae0a3c09b8f276dbf5bda96b3819218204e88ec1e5c517d87353d6539b3c75bb97922c5ce2b75c4d34070ab15bfb4f4320fc5855c16d405c28d0797af878798187277a899036d7f79efbc062d22f897065989937d0cb1b31b00"}}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48e, 0x0, 0x40}]}) executing program 9: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_ACT={0x30, 0x3, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) executing program 9: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) getsockopt(r2, 0x111, 0x4, 0x0, &(0x7f0000000080)) executing program 9: pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r1, 0x0, 0xf3a, 0x0) tee(r0, r4, 0xf3a, 0x4) write$binfmt_elf64(r2, &(0x7f0000000380)=ANY=[], 0x18c6) executing program 9: r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004898b610c2154100201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x8, &(0x7f0000000040)=ANY=[]) executing program 4: r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x20, 0x0, 0x2, 0x0, @rand_addr, @multicast1=0xe0000300}, @address_request}}}}, 0x0) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0x1, 0xb}, {0x7, 0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000200)=0x9) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000380)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000500)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000000)=0x84, 0xfde1) sendto$inet6(r0, 0x0, 0x0, 0x200c8084, &(0x7f0000000080)={0xa, 0x4e28, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x6}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, 0x0, 0x0) recvmmsg(r0, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40002003, 0x0) executing program 3: r0 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000400)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xc3) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r2, 0xe6) keyctl$KEYCTL_WATCH_KEY(0x20, r0, r1, 0xffffffffffffffff) executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x6c, 0x2c, 0xf3f, 0x70bd2b, 0x25dfdbbd, {0x0, 0x0, 0x0, r2, {0xffe0, 0xc}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x3c, 0x2, [@TCA_BASIC_EMATCHES={0x38, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x2c, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x8, 0x7, 0x6}, {{0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x7fff, 0x7, 0x7, 0xff07}, {{0x2, 0x1}, {0x4, 0x1}}}}]}]}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20041090}, 0x4880) executing program 3: socket$inet6_tcp(0xa, 0x1, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x14}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x40080}, 0x24000000) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000180640fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e224e22", @ANYRES32=0x0, @ANYRES32=0x41424344, @ANYBLOB="601810"], 0x0) executing program 3: r0 = socket(0x10, 0x803, 0x0) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000001007b"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000000000)=0x3, 0x4) recvmmsg(r0, &(0x7f0000000c40)=[{{0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000700)=""/23, 0x17}, 0x80009}], 0x16c, 0x10002, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2d, 0x1ffffffc, {0x0, 0x0, 0x0, r2, 0x61646, 0x3020}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x480) executing program 3: r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), 0x4) sendmsg$tipc(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x8820) executing program 4: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1b}}, 0x20) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d}, 0x94) io_uring_enter(r0, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000040), 0x4) read(r0, &(0x7f0000000080)=""/135, 0x87) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b000000000006000100070000000c00100000000000000000000c000f"], 0x6c}, 0x1, 0x0, 0x0, 0x40811}, 0x20) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x6) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000002c0)={0xe5, 0x0, [{0x80000001, 0x2, 0x4, 0x8001}]}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r3, 0xffffffffffffffff, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 1: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 39: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 2: r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x1) r1 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r1, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r2) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='lp', 0x2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) executing program 0: renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0x76, 0x101341) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0x12d) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0x80045515, &(0x7f0000000100)=@usbdevfs_driver={0x80000001, 0x6, 0x0}) executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x200, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x4, 0x8, 0x409, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) pread64(r0, &(0x7f0000000700)=""/115, 0x73, 0x5) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x8}) close(r0) executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206030000000000000000000000000011000300686173683a6e65742c6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007800800084000000078050014"], 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0x122, @tick=0x7, 0x0, {}, 0xfc, 0x0, 0x8}) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x0, 0xd13a5dbb099f029b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: io_submit(0x0, 0x0, &(0x7f0000000140)) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040ba124b0700000000000109022400010000102c09040005010300010009210080090122180009058103"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <23> bisect: split chunk #0 of len 23 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 1: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 39: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000140)=[@in={0x2, 0x4e24, @rand_addr=0x64010100}], 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000280)={r2, 0x371fee32, 0xa2, 0x98a}, &(0x7f0000000200)=0x10) executing program 2: r0 = open(&(0x7f0000000180)='.\x00', 0x0, 0x0) flock(r0, 0x1) r1 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) flock(r1, 0x1) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r2) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='lp', 0x2) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) executing program 0: renameat2(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c, &(0x7f0000000140)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000340), 0x76, 0x101341) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0x12d) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0x80045515, &(0x7f0000000100)=@usbdevfs_driver={0x80000001, 0x6, 0x0}) executing program 2: r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {0x4, 0xa}, {0xb}, {0x4}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x40, 0xfc, 0x200, 0x400a, 0x0, 0xfffffffd, 0x7e}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x4, 0x8, 0x409, 0x2, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x24008814}, 0x20000040) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x4, 0x7, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000100000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9e}) executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) pread64(r0, &(0x7f0000000700)=""/115, 0x73, 0x5) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240)={0x8}) close(r0) executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000000206030000000000000000000000000011000300686173683a6e65742c6e657400000000050001000700000005000500020000000900020073797a30000000000500040000000000140007800800084000000078050014"], 0x60}, 0x1, 0x0, 0x0, 0x2c0c0}, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000400)={0x122, @tick=0x7, 0x0, {}, 0xfc, 0x0, 0x8}) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1000, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a40)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x0, 0x4, {0x0, 0xd13a5dbb099f029b}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 2: io_submit(0x0, 0x0, &(0x7f0000000140)) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000200000040ba124b0700000000000109022400010000102c09040005010300010009210080090122180009058103"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <12> bisect: split chunk #0 of len 12 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 6: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)={0x1, 0x0, [{0x26000, 0xe9, &(0x7f0000000380)=""/233}]}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, 0x0, 0x40000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000002c0)=0x1) executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 6: r0 = socket$inet_sctp(0x2, 0x1, 0x84) shutdown(r0, 0x1) poll(&(0x7f0000000000)=[{r0, 0x10}], 0x1, 0x3ff) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) accept4(r0, 0x0, 0x0, 0x0) executing program 6: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 38: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) munmap(&(0x7f0000aaf000/0x1000)=nil, 0x1000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6, 6, 6, 6, 6, 6] detailed listing: executing program 37: syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902"], 0x0) syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x80) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/power/pm_print_times', 0x2242, 0x114) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') close_range(r0, 0xffffffffffffffff, 0x0) executing program 1: r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x200) ioctl$MON_IOCX_MFETCH(r0, 0xc00c9207, &(0x7f0000000080)={0x0, 0x0, 0x7fff}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) executing program 6: bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) write$cgroup_type(r1, &(0x7f0000000140), 0x9) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: split chunks (needed=true): <6> bisect: split chunk #0 of len 6 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6, 6, 6] detailed listing: executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x13, r2, 0x0) r3 = syz_open_dev$mtd(&(0x7f0000000200), 0x0, 0x8000) readv(r3, &(0x7f0000001980)=[{&(0x7f0000001940)=""/13, 0x20000}, {0x0, 0xffb6}], 0x2) executing program 6: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000001c0)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x40080, &(0x7f000005ffe4)={0xa, 0xffff, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x7b) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0xfc, 0x0, 0x0, 0x40, 0xfd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x0, 0x0) executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 6] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 0: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) program did not crash minimized 6 calls -> 6 calls minimizing program #1 before concatenation testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$FE_GET_EVENT(r0, 0x80286f4e, &(0x7f0000000140)) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 4] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 2] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x0, 0x51}, &(0x7f0000000100), &(0x7f0000000000), &(0x7f0000000080)) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 1] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 0] detailed listing: executing program 1: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) executing program 0: program crashed: KASAN: slab-use-after-free Read in dvb_device_open minimized 6 calls -> 0 calls testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open bisect: concatenation succeeded found reproducer with 6 syscalls minimizing guilty program testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program did not crash testing program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(0x0, 0x0, 0x40002) program did not crash extracting C reproducer testing compiled C program (duration=1m23.147097514s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open simplifying C reproducer testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program did not crash testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing compiled C program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend program crashed: KASAN: slab-use-after-free Read in dvb_device_open testing program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true testing program (duration=1m23.147097514s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-fcntl$lock-mprotect-timer_settime-mmap-syz_open_dev$dvb_frontend detailed listing: executing program 0: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f076bbee2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) program crashed: KASAN: slab-use-after-free Read in dvb_device_open validation run: crashed=true reproducing took 1h57m56.279173439s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x340 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff88802be78c18 b Read of size 8 at addr ffff88802be78c18 by task syz.0.19/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 dvb_device_open+0xc4/0x340 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71875ab Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000ffd4d86c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000ffd4d930 RDX: 0000000000040002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_register_device+0x309/0x1dd0 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x603/0x900 drivers/media/dvb-core/dvb_frontend.c:3074 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x9d5/0xf60 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0xf9/0x190 drivers/base/platform.c:1507 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __driver_attach+0x339/0x600 drivers/base/dd.c:1292 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x345/0x670 drivers/base/bus.c:763 driver_register+0x23a/0x320 drivers/base/driver.c:174 vidtv_bridge_init+0x3d/0x60 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5846: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6509 [inline] kfree+0x1c5/0x650 mm/slub.c:6802 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put drivers/media/dvb-core/dvbdev.c:629 [inline] dvb_device_open+0x2b8/0x340 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 The buggy address belongs to the object at ffff88802be78c00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff88802be78c00, ffff88802be78d00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2be78 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b041b40 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b041b40 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15192722525 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] bus_add_driver+0x162/0x670 drivers/base/bus.c:747 driver_register+0x23a/0x320 drivers/base/driver.c:174 usb_register_driver+0x1e4/0x390 drivers/usb/core/driver.c:1082 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 page_owner free stack trace missing Memory state around the buggy address: ffff88802be78b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802be78b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802be78c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802be78c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802be78d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 56 push %rsi 2: 53 push %rbx 3: 8b 44 24 14 mov 0x14(%rsp),%eax 7: f6 00 08 testb $0x8,(%rax) a: 75 23 jne 0x2f c: 8b 44 24 18 mov 0x18(%rsp),%eax 10: 8b 5c 24 1c mov 0x1c(%rsp),%ebx 14: 8b 4c 24 20 mov 0x20(%rsp),%ecx 18: 8b 54 24 24 mov 0x24(%rsp),%edx 1c: 8b 74 24 28 mov 0x28(%rsp),%esi 20: 8b 7c 24 2c mov 0x2c(%rsp),%edi 24: 8b 6c 24 30 mov 0x30(%rsp),%ebp 28: cd 80 int $0x80 * 2a: 5b pop %rbx <-- trapping instruction 2b: 5e pop %rsi 2c: 5f pop %rdi 2d: 5d pop %rbp 2e: c3 ret 2f: 5b pop %rbx 30: 5e pop %rsi 31: 5f pop %rdi 32: 5d pop %rbp 33: e9 f7 a1 ff ff jmp 0xffffa22f 38: 66 90 xchg %ax,%ax 3a: 66 90 xchg %ax,%ax 3c: 66 90 xchg %ax,%ax 3e: 90 nop 3f: 53 push %rbx final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in dvb_device_open+0xc4/0x340 drivers/media/dvb-core/dvbdev.c:99 Read of size 8 at addr ffff88802be78c18 b Read of size 8 at addr ffff88802be78c18 by task syz.0.19/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz.0.19 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 dvb_device_open+0xc4/0x340 drivers/media/dvb-core/dvbdev.c:99 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 RIP: 0023:0xf71875ab Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000ffd4d86c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000ffd4d930 RDX: 0000000000040002 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x321/0x600 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] dvb_register_device+0x309/0x1dd0 drivers/media/dvb-core/dvbdev.c:472 dvb_register_frontend+0x603/0x900 drivers/media/dvb-core/dvb_frontend.c:3074 vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline] vidtv_bridge_probe+0x9d5/0xf60 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510 platform_probe+0xf9/0x190 drivers/base/platform.c:1507 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __driver_attach+0x339/0x600 drivers/base/dd.c:1292 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x345/0x670 drivers/base/bus.c:763 driver_register+0x23a/0x320 drivers/base/driver.c:174 vidtv_bridge_init+0x3d/0x60 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 5846: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6509 [inline] kfree+0x1c5/0x650 mm/slub.c:6802 dvb_free_device drivers/media/dvb-core/dvbdev.c:616 [inline] kref_put include/linux/kref.h:65 [inline] dvb_device_put drivers/media/dvb-core/dvbdev.c:629 [inline] dvb_device_open+0x2b8/0x340 drivers/media/dvb-core/dvbdev.c:113 chrdev_open+0x4d9/0x600 fs/char_dev.c:411 do_dentry_open+0x816/0x1380 fs/open.c:996 vfs_open+0x3b/0x340 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1443/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_compat_sys_openat fs/open.c:1485 [inline] __se_compat_sys_openat fs/open.c:1483 [inline] __ia32_compat_sys_openat+0x131/0x160 fs/open.c:1483 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] do_int80_emulation+0x198/0x500 arch/x86/entry/syscall_32.c:166 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:598 The buggy address belongs to the object at ffff88802be78c00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 24 bytes inside of freed 256-byte region [ffff88802be78c00, ffff88802be78d00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2be78 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b041b40 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b041b40 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15192722525 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x39b/0x600 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] bus_add_driver+0x162/0x670 drivers/base/bus.c:747 driver_register+0x23a/0x320 drivers/base/driver.c:174 usb_register_driver+0x1e4/0x390 drivers/usb/core/driver.c:1082 do_one_initcall+0x250/0x870 init/main.c:1362 do_initcall_level+0x10a/0x1a0 init/main.c:1424 do_initcalls+0x59/0xa0 init/main.c:1440 kernel_init_freeable+0x29d/0x3e0 init/main.c:1675 kernel_init+0x22/0x1d0 init/main.c:1565 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 page_owner free stack trace missing Memory state around the buggy address: ffff88802be78b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802be78b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802be78c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802be78c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802be78d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 57 push %rdi 1: 56 push %rsi 2: 53 push %rbx 3: 8b 44 24 14 mov 0x14(%rsp),%eax 7: f6 00 08 testb $0x8,(%rax) a: 75 23 jne 0x2f c: 8b 44 24 18 mov 0x18(%rsp),%eax 10: 8b 5c 24 1c mov 0x1c(%rsp),%ebx 14: 8b 4c 24 20 mov 0x20(%rsp),%ecx 18: 8b 54 24 24 mov 0x24(%rsp),%edx 1c: 8b 74 24 28 mov 0x28(%rsp),%esi 20: 8b 7c 24 2c mov 0x2c(%rsp),%edi 24: 8b 6c 24 30 mov 0x30(%rsp),%ebp 28: cd 80 int $0x80 * 2a: 5b pop %rbx <-- trapping instruction 2b: 5e pop %rsi 2c: 5f pop %rdi 2d: 5d pop %rbp 2e: c3 ret 2f: 5b pop %rbx 30: 5e pop %rsi 31: 5f pop %rdi 32: 5d pop %rbp 33: e9 f7 a1 ff ff jmp 0xffffa22f 38: 66 90 xchg %ax,%ax 3a: 66 90 xchg %ax,%ax 3c: 66 90 xchg %ax,%ax 3e: 90 nop 3f: 53 push %rbx